Security Engineer (Hiring Immediately)

Role purpose

Legatics handles some of the world's most complex and confidential legal transactions, so security is core to our product and to client trust. As our Security Engineer, you will make our platform, cloud estate and internal systems secure by design, working hand in hand with our engineering team.

Reporting to the Head of Engineering, this is a permanent, hands-on role where you will work at least two days a week in our London office. Your core focus is application and product security, cloud, identity and endpoint security, and security monitoring and detection. You will also lead incident response and help set our approach to AI security as our teams build with agentic tools.

For around the first 12 months, you will also own our ISO 27001, compliance and client assurance work, supported by AI tooling we have already built for client questionnaires and ISO evidence. This is a broad role with real autonomy, suited to someone who enjoys both building and securing.

About Legatics

Legatics is one of the world's leading LegalTech scale-ups. Our legal transaction management platform enables law firms and their clients to collaborate on and close deals in an interactive online environment, providing clarity, reducing risk and saving time.

Our customers include some of the world's top law firms, such as A&O Shearman, Hogan Lovells, Herbert Smith Freehills and King & Wood Mallesons. Legatics has been used on transactions in more than 60 countries, worth over $1 trillion.

Key responsibilities

Application and product security

• Carry out technical risk assessments on new and existing product features, including permissions and access control design.
• Embed security into our software development lifecycle through threat modelling, secure code review and security requirements for new features.
• Perform vulnerability and exploitability analysis, including CVE triage and dependency risk, and prioritise remediation with engineers based on real exposure.
• Operate and consolidate our security scanning and posture tooling, and centralise findings so they are tracked and resolved.
• Review the security risk of proposed integrations and data flows, including third-party tools and automations.
• Run a programme of continuous security testing, including penetration tests, and own remediation of findings.

Cloud, identity and endpoint security

• Audit and harden our cloud and identity posture, including SSO enforcement, conditional access and third-party app controls.
• Automate joiner and leaver access, and run periodic user access reviews across our SaaS estate.
• Own email security and authentication.
• Own endpoint security across our Windows and Mac fleet, including EDR policy tuning and validation testing.
• Design and maintain federated authentication with clear rollout guides and rollback procedures.

Security monitoring and detection

• Build, extend and maintain security monitoring across our technical estate, including log aggregation, correlation and alerting.
• Tune detection rules and alerting to improve signal quality and reduce false positives.
• Maintain threat intelligence and security news pipelines to keep the team informed.

Incident response

• Lead detection, triage, containment and response for security incidents, including supply-chain compromises affecting third-party tools.
• Assess blast radius, advise on practical containment and maintain escalation and breach procedures.
• Write clear incident communications for technical and non-technical audiences, including clients where needed.

AI security

• Shape our AI security posture, positioning security as an enabler for teams building with AI and agentic tools.
• Implement access controls, secrets scanning and detection for internal AI systems and MCP integrations, mapped to frameworks such as the OWASP Top 10 for Agentic Applications.
• Research AI coding risks, such as slopsquatting and hallucinated packages, and feed findings into engineering practice.

ISO 27001, compliance and client assurance

For around the first 12 months, you will own:

• Our ISO 27001:2022 certified ISMS, including the risk register, Statement of Applicability, policies and audit evidence, and preparation for surveillance audits.
• Client information security questionnaires and security queries from our commercial team, using the AI tooling we have built to speed these up.
• Client conversations about our security posture and remediation updates, for example on penetration test findings.

After this period, you will continue to contribute technical controls, evidence and expertise to our ISMS and client assurance work.

IT operations

• Support day-to-day IT a]]>