Security Control Engineer

About the role

You will own the technical design and operational execution of security controls that protect our cloud-native banking platform and ensure business continuity. You will evaluate complex threats and risks across distributed environments and translate them into robust, auditable solutions. You will collaborate closely with engineering, product, and client teams to balance security requirements with delivery velocity. You will leverage Thought Machine's standards and risk frameworks to shape security expectations and influence industry practices. You will document control designs, processes, and evidence in a clear and compelling manner for both technical and audit audiences. You will champion creative problem-solving to address hard security challenges that arise from modern financial infrastructure. You will act as a trusted advisor on security matters, ensuring our controls remain resilient and aligned with regulatory expectations. You will contribute to a culture of continuous improvement by monitoring evolving threats and refining our security and business continuity programs.

Key facts

What you'll do

Design and implement security and business continuity controls that reduce risk to acceptable levels across our cloud and on-premise environments.

Develop and operate continuous assurance processes and tooling that generate audit evidence in support of certifications such as ISO27001, ISO22301, PCI-DSS, and SOC 2 Type 2.

Communicate technical security approaches to clients by producing accurate, detailed, and up-to-date materials that explain Thought Machine's security posture.

Ensure the security control lifecycle remains current by incorporating new threats, technical advances, and evolving regulatory and industry standards in a timely manner.

Partner with cross-functional teams to align security controls with product delivery, operational resilience, and client requirements.

Apply creativity and rigorous analysis to solve complex security problems while maintaining consistency with Thought Machine's engineering-led culture.

Quantify risk and control effectiveness to support evidence-based decisions and prioritization of security investments.

Monitor, maintain, and improve the Information Security Management System (ISMS) and Business Continuity Management System (BCMS) to sustain industry best practices.

Contribute to internal security standards, processes, and guidance that reinforce Thought Machine's position as an innovative and trusted fintech provider.

Act as a technical authority on security matters, advising both internal stakeholders and external auditors with clarity and precision.

Requirements

You possess a strong technical background that enables you to reason about security in distributed cloud-based and on-premise computing environments.

You have demonstrable experience in evaluating threats and risks within an organisation and using that understanding to design and implement appropriate controls.

You have hands-on experience defining control requirements and translating them into technical and operational solutions.

You hold the ability to communicate and collaborate on trade-offs between differing security control approaches with internal teams and external clients.

You are comfortable working within frameworks and standards such as ISO27001, ISO22301, PCI-DSS, and SOC 2, understanding how they drive control design and assurance activities.

You bring experience in supporting or maintaining information security and business continuity management systems, including control monitoring and evidence collection.

You have a track record of working effectively in regulated environments where security, resilience, and auditability are paramount.

You approach problem-solving with creativity, collaboration, and a commitment to continuous improvement in security and operational resilience.

Nice to have

Experience in financial services or regulated environments where security and compliance requirements are strict.

Familiarity with security tooling, automation, and evidence generation for audits and certifications.

Understanding of cloud security architectures, identity and access management, and incident response practices.

Practical notes

This is a full-time, permanent position based in our Lisbon office, requiring four days a week onsite.

About Thought Machine

Thought Machine is hiring for Security Control Engineer. The listing location is Portugal, Lisbon.

This Security Control Engineer opening is posted for Portugal, Lisbon.