Sr. Security Engineer - GRC Fintech & Financial Services EU/UK
Likely
Sponsorship likelihood
This employer has issued visas recently
Not disclosed
Salary
Not disclosed by employer
£48,500
Going rate
Skilled Worker going rate
This role likely qualifies for a Skilled Worker visa
SOC 2135 (72% match) is an eligible occupation, with a going rate of £48,500, and X.AI LONDON LTD is a licensed sponsor. That is our reading of the rules. Whether they issue a Certificate of Sponsorship is still their call.
In 2025, X.AI LONDON LTD assigned Certificates of Sponsorship for other occupations, but none for SOC 2135, according to the Home Office.
This could also be SOC 2482 (Quality assurance and regulatory professionals). We read the code off the advert, so it is our best guess, not the employer's.
New graduate or PhD holder? Pick one of the lower rates.
What each route needs for this job
| Occupation code | New entrant 70% of going rate | STEM PhD 80% of going rate | Relevant PhD 90% of going rate | Standard rate 100% of going rate |
|---|---|---|---|---|
2135 Cyber security professionals Most likely code | £34,000 | £38,800 | £43,700 | £48,500 |
2482 Quality assurance and regulatory professionals Also possible | £33,800 | £38,600 | £43,400 | £48,200 |
We use the lowest threshold across the plausible codes. Likelihood is Possible at most when the pay clears only a lower rate, or only under a less likely code. How the Home Office picks the code
About the role
SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars.
SpaceXSI is building Super Intelligence to understand the universe and help expand humanity’s knowledge and capabilities. We work across the full Super Intelligence stack: compute (Colossus supercomputers), models (Grok), and applications (Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X). We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next.
ABOUT THE ROLE:
We are seeking an experienced Governance, Risk, and Compliance (GRC) Engineer focused on European Union and United Kingdom information security and financial services regulation to help scale compliance for SpaceXSI and xMoney. As we expand deeper into regulated EU/UK markets, maintaining a robust, transparent, and technically sound information security GRC program is critical. You will architect the systems and processes that automate trust — a pragmatic operator who understands that GRC exists to enable the business, balancing rigorous standards with the velocity of a high-growth company. The ideal candidate brings hands-on experience with frameworks such as DORA, the EU AI Act, NIS2, and related EU/UK information security and operational resilience obligations, plus GRC engineering skills: Compliance-as-Code, continuous evidence collection, and deep partnership with engineering so controls are designed into the platform rather than bolted on after the fact.
This role may also include additional tasks and responsibilities as needed to support the team and evolving business priorities. This position may require occasional travel.
RESPONSIBILITIES:
- Own and evolve EU/UK financial services and digital operational resilience posture across DORA (including ICT risk management, incident reporting, resilience testing, and third-party ICT provider oversight), and complementary expectations from EBA/ESMA/EIOPA guidance, PSD2/PSR where applicable, and UK PRA/FCA operational resilience requirements supporting xMoney.
- Build and maintain Compliance-as-Code capabilities — policy-as-code, automated control validation, continuous evidence collection, and monitoring integrated into CI/CD — so audit and supervisory readiness scales with the business rather than depending on manual, point-in-time checks.
- Operate and extend GRC platforms (e.g., Vanta) as the backbone for control mapping, evidence management, and continuous compliance; integrate with cloud, identity, logging, and engineering systems to reduce administrative bottlenecks.
- Partner with Architects and Engineering Leads to bake EU/UK information security and regulatory requirements into design early; translate complex obligations into concrete technical implementations and auditor- or supervisor-ready narratives without slowing development.
- Design, implement, and validate technical information security controls relevant to regulated EU/UK environments (access control, logging and monitoring, encryption, change management, vulnerability management, ICT third-party oversight, and secure SDLC) — not just document them.
- Operate the cybersecurity and compliance risk register — identify, quantify, and track risks, distinguishing theoretical gaps from meaningful business and regulatory risk under EU/UK supervisory expectations.
- Lead information security risk assessments and compliance reviews for new products, features, vendors, and architectural changes that affect the EU/UK regulated attack surface, including ICT third-party / critical provider diligence aligned to DORA.
- Liaise with the Data Privacy team on security-relevant intersections (e.g., security measures supporting confidentiality and integrity.
BASIC QUALIFICATIONS:
- Bachelor's degree in computer science, Information Security, Cybersecurity, or in an engineering/STEM field.
- 8+ years of experience in GRC, information security compliance, or technology audit roles in fintech, banking, payments, or other heavily regulated environments with EU and/or UK exposure.
- Hands-on experience implementing or operating controls against several of the following: DORA, the EU AI Act, NIS2, PSD2/PSR, or UK PRA/FCA operational resilience expectations — not only reading the requirements.
- Familiar with data privacy regulations applicable to the EU/UK region (e.g., EU GDPR, UK GDPR, UK Data Protection Act 2018) sufficient to liaise with Privacy counterparts.
- Experience with Compliance-as-Code practices and GRC automation tooling (e.g., Vanta, or similar), with a bias toward continuous monitoring and reducing manual evidence collection.
- Technical fluency sufficient to speak the language of engineering, On-premises, hybrid, or cloud (AWS/GCP/Azure), and security architecture, and to anticipate how design decisions impact information security risk and compliance.
PREFERRED SKILLS AND EXPERIENCE:
- 10+ years of information security compliance, GRC engineering, or technology audit-related experience in fintech or financial services with a primary EU/UK focus.
SpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice.
This description is the source posting as it read when we added it. We are not affiliated with X.AI LONDON LTD, so check their own site for the current details.
Where this offer sits in the market
Cyber security professionals (SOC 2135) · UK · ONS ASHE 2025 · basic pay · ~30k in sample- Middle half £43,680–69,316
- Median £51,376
- Going rate £48,500
- Threshold £41,700
- New entrant £34,000–43,700
Similar sponsored roles
See all UK visa jobsNo close matches live right now.
Browse more sponsored jobs at X.AI LONDON LTDAbout sponsorship for this role
Does this job guarantee visa sponsorship?
Not necessarily. X.AI LONDON LTD holds a sponsor licence, but sponsorship for a specific hire is always the employer's decision. In 2025, X.AI LONDON LTD assigned Certificates of Sponsorship for other occupations, but none for SOC 2135, according to the Home Office. Be upfront in your application that you'll require it.
What salary is needed for this role to be eligible?
The offer must clear both the general threshold and the SOC 2135 going rate of £48,500. New-entrant and shortage discounts can lower it.