Lead DevSecOps Engineer

Description

You will secure the AI products that change how infrastructure and buildings are designed and engineered, cutting waste and CO2 and making the built environment more efficient and sustainable. Your job is to make sure these products and the platforms behind them are secure from the start.

The AI Engineering team is small and highly technical. It works with the speed and ownership of a startup and draws on the scale, resources and domain knowledge of a leading global engineering firm.

You will report to the CIO and have authority to make security sign-off decisions on new products and features. The security team may grow as the products and platform scale, and you will help shape it.

The company is a global infrastructure consultancy working across water, environment, energy, transportation and buildings. It is a Fortune 500 firm with over 50,000 people and revenue of $16.1 billion in fiscal year 2025.

Responsibilities

• Act as the security lead for the products and platform, from early design review through to production.
• Hold sign-off authority for launches, setting risk-based release criteria so low-risk changes ship quickly and higher-risk changes get deeper review, while working with engineers to cut risk without slowing delivery.
• Run security reviews from design to launch, using threat modelling on architecture, data flows and third-party dependencies, recording findings and agreeing proportionate fixes with product teams.
• Own security for AI and LLM features: threat model prompt injection, data leakage through prompts and outputs, unsafe agent tool use and abuse of model endpoints, then define guardrails and tests.
• Assess the AI supply chain, including third-party models, model providers, vector stores, and the data used for training and retrieval.
• Own CVE remediation across code, dependencies, container images and cloud infrastructure, prioritising by real-world exploitability and agreeing patch deadlines with engineering teams.
• Keep SAST, SCA, secret, container and Infrastructure as Code scanning in CI/CD current and well tuned, so engineers get quick, useful feedback with little noise.
• Run the penetration testing programme: scope engagements, work with external testers, lead the review of findings and track fixes through to verified closure.
• Strengthen cloud and identity security on Azure and GCP, covering identity and access management, networking, secrets and keys, logging and cloud security posture.
• Lead the response to security incidents and actively exploited vulnerabilities, coordinating containment, fixes and post-incident reviews, and keep runbooks current.
• Set up and run a security champions programme across engineering teams to build shared ownership of security.

Requirements

• Hands-on experience in security engineering, application or product security, DevSecOps or similar roles, including technical leadership.
• A proven record of leading security reviews and threat modelling for products and features, and making clear, proportionate sign-off decisions.
• Strong vulnerability management and incident response experience, including CVE triage, risk-based prioritisation and driving fixes across code, containers and cloud infrastructure.
• Hands-on experience maintaining and tuning security scanning in CI/CD pipelines, such as SAST, SCA, secret, container and IaC scanning, ideally with GitHub Actions and Terraform.
• Experience running penetration tests end to end, from scoping and vendor coordination to reviewing findings and verifying fixes.
• A solid understanding of cloud security on Microsoft Azure and/or GCP, including identity and access management, networking and secrets management.
• The ability to explain risk clearly and influence engineers, product owners and leaders.
• A track record of working at pace in fast-moving teams, making sound security decisions quickly without blocking delivery.
• Experience in a large global organisation, working across regions, business units and enterprise governance and compliance processes.
• Preferred: experience securing AI/ML and LLM-based applications, with familiarity with the OWASP Top 10 for LLM Applications or MITRE ATLAS.
• Preferred: experience securing containerised workloads and software supply chains, such as SBOMs and artifact signing.
• Preferred: experience applying frameworks such as NIST, CIS, ISO 27001 or SOC 2 in regulated or enterprise environments.
• Preferred: relevant certifications such as OSCP, CISSP, GWAPT, Microsoft Certified Azure Security Engineer Associate, or equivalent.

Conditions

You must attend an in-person Day 1 onboarding at a company office location as a condition of employment, as part of its secure hiring process.

Applicants with a disability or long-term condition who meet the essential criteria are offered an interview under the Disability Confident scheme, and all applicant information is kept confidential under EEO guidelines.

Benefits

• Work on real-world problems where AI has measurable impact.
• See your ideas turn into working products.
• Work with capable, driven colleagues in a team built on trust, ownership and high standards.
• Help make the built environment smarter and more sustainable.
• Get access to cutting-edge technology and a network of experts.
• Take part in award-winning training and development that builds technical and leadership skills.
• Depending on employment status, benefits may include medical, dental and vision cover, life, AD&D and disability benefits, paid time off, leaves of absence, voluntary benefits and perks, flexible work options, well-being resources, an employee assistance program, business travel insurance, service recognition awards, a retirement savings plan and an employee stock purchase plan.