The role
Nelum holds identity documents, company records and an audit trail that counterparties rely on as evidence. We are seeking a Security Engineer to protect them across the application, the cloud platform and the third-party services the platform depends on.
Nelum is a compliance and documentation platform. It holds no client funds and runs no trading engine; the asset to protect is the integrity and confidentiality of the record.
Key responsibilities
Application and platform security
- Review and harden authentication, authorisation and access rules across the web application, its APIs and its database and storage rules.
- Secure the cloud environment: identity and access management, secrets, network exposure and deployment pipelines.
- Build security checks into CI so that a regression fails a build rather than reaching production.
Data protection
- Protect identity and verification data end to end, including retention and deletion.
- Support compliance with UK GDPR, Nigeria's NDPA and the UAE's data-protection law.
Detection and response
- Establish logging, monitoring and alerting across the platform.
- Own the incident-response plan and lead the response when an incident occurs.
Assurance
- Commission and follow up penetration tests.
- Review the security of vendors — identity verification, sanctions screening, payments and email.
- Prepare the company for ISO 27001 or SOC 2 as it grows.
Ideal candidate
Five or more years in application or cloud security, ideally in financial services, fintech or another regulated sector.
Hands-on experience with a major cloud platform, web-application security and incident response.
Qualifications
- CISSP, CISM, OSCP or an equivalent certification is desirable.
Engagement
Full-time. Full-time.
About Nelum
Nelum is a technology company building compliance-as-a-service and market-access infrastructure for artisanal and small-scale mining and the wider commodities sector. The platform helps licensed miners, mining cooperatives and commodity businesses become verified, compliant and buyer-ready, and improves transparency, traceability and responsible sourcing across international supply chains.
The platform is built to operate internationally. It is commodity-agnostic and corridor-based: a new producing country or a new material is a configuration of the same system rather than a separate build. The commodity scope is precious metals; tin, tantalum and tungsten; battery and technical metals; precious stones; and oil.
Our first corridor is Nigeria to Dubai, and our first material is gold — chosen because it is the hardest provenance environment in commodities. The company is structured for that reach from the outset: a UK parent, an intended operating entity in Dubai, engineering resourced internationally, and field operations beginning in Nigeria. The public platform runs in English, Arabic and Chinese.