Lead Security Engineer

Job Summary:

As Lead Security Engineer you will set the technical direction for security engineering across both the defensive, AppSec and CloudSec, and offensive, PenTest and SecOps, disciplines, acting as the senior technical authority for the wider team. You will combine deep hands on credibility with the ability to prioritise, resource and represent the security engineering roadmap to Cyber leadership and the broader business, while directly mentoring senior and junior engineers across the function.

Responsibilities and Tasks:

1. Technical Strategy & Roadmap

• Define and own the technical strategy across secure software design, cloud infrastructure defence, offensive testing and incident detection, aligning priorities with Cyber leadership's wider goals.
• Represent the security engineering function in cross functional and executive forums, translating technical risk into business impact for non-technical stakeholders.

2. Secure Engineering & Cloud Defence

• Direct the integration of automated security controls into engineering pipelines and cloud infrastructure, setting the standard that senior and junior engineers build against.
• Own escalation and final sign off on complex cloud architecture, Identity and Access Management and Zero Trust design decisions.

3. Offensive Assurance & Incident Leadership

• Set the standard and cadence for penetration testing, red team simulations and detection engineering across the estate.
• Act as the senior technical escalation point during critical security incidents, directing containment and post incident review.

4. Team Leadership & Mentorship

• Mentor senior and junior security engineers across both tracks, shaping career development and technical growth within the team.
• Partner with Talent Acquisition and Cyber leadership on hiring, structuring the security engineering career ladder and resourcing decisions.

Qualifications

• Education: Bachelor's degree required in Computer Science, Cyber Security, Software Engineering or a related technical discipline. A Master's degree is preferred.
• Core Experience: Indicative range [8 or more years] of progressive engineering experience, with demonstrated depth in either the defensive or offensive discipline and strong working fluency across both.
• Cross Discipline Credibility: hands on seniority in application security, cloud architecture defence, penetration testing or security operations, with the range to speak authoritatively across the wider function.
• Cloud, DevOps & Exploitation Stack: deep practical knowledge spanning public cloud topologies, containerisation and orchestration, GitLab CI pipelines, and manual testing and forensic tooling.
• AI & Regulatory Mastery: expert level understanding of the OWASP Top 10 for LLMs, applied cryptography and federated authentication architectures, together with practical experience aligning controls to PCI-DSS (v4.0), SOC 1, SOC 2 and DORA.
• Leadership Track Record: prior experience mentoring engineers, shaping technical roadmaps or influencing hiring and resourcing decisions within a security or engineering function.

Skills and Abilities:

• Moves credibly between builder and breaker mindsets, equally comfortable setting defensive architecture standards and directing offensive assurance work.
• Leads with influence rather than authority alone, able to prioritise competing security priorities and represent them clearly to executive stakeholders.
• Brings calm, analytically clear decision making under pressure and uses that same clarity to coach senior and junior engineers through complex incidents.
• Resilience and analytical clarity in high-pressure scenarios, setting the standard for transparent communication and directing risk-based decisions across the team during active security incidents or compressed financial product launch windows.
• Balances technical risk reduction with business enablement, owning security infrastructure as a competitive advantage that unblocks global revenue and enterprise-client acquisition across the wider business.