Lead Security Engineer

Description

The company builds digital services, Workday solutions and technology products, and works with agile delivery teams to bake security into the software development lifecycle.

This is a Lead Security Engineer (Consultant) role that sets the security testing direction across the company's platforms and services, including methodology, engagement scoping, outputs and tool choices.

You will lead a small team, managing performance and supporting career development.

Responsibilities

• Set the direction for security testing methodology, engagement scoping, outputs and tool and technology selection.
• Lead security engineering and security testing across the company's platforms and services.
• Develop junior security engineers.
• Work with agile delivery teams to build good security practices into the software development process.
• Act as a technical leader, sharing knowledge and educating customers and colleagues on good security practice.
• Manage, coach and develop a small number of staff, including their performance and career growth.
• Give direction to your team and work with them to solve hard problems.

Requirements

• Deep experience securing web applications and cloud platforms such as AWS or Azure.
• Experience in the defence sector.
• A current, active security clearance.
• Skilled at testing software and infrastructure security with manual or automated tools, including performing and documenting penetration tests on web applications, networks and computer systems.
• Skilled at reviewing software and infrastructure source code for security issues.
• Strong experience with continuous security, continuous integration and continuous delivery.
• Knowledge of international security standards and regulations such as NCSC, NIST, CIS, PCI, GDPR, OWASP ASVS, HIPAA and SOC2.
• Knowledge of common attack vectors such as the OWASP Top 10, SQL injection, XSS, XXE and MITM, and the ability to explain threats and risks through threat modelling workshops.
• Strong communication skills, with the ability to explain security complexity to audiences with varied technical backgrounds.
• A proven record of managing, mentoring and coaching team members and the wider community.
• Good programming or scripting skills on Windows, Linux and macOS.
• Keeps current with new threats and attack methods.

Conditions

Equal opportunity: the company welcomes applicants from all backgrounds and offers adjustments on request, with a private conversation to tailor the recruitment process.