Senior Security & Compliance Engineer

Description

Lead the security of cutting-edge construction technology

At XYZ Reality, we've created the world's first engineering-grade Augmented Reality solution for construction. Our product, The Atom, is used on major projects worldwide to bring designs to life on-site and help teams build more accurately, efficiently and with fewer mistakes.

As a Series B business scaling across the UK, US and Europe, our technology, and the security environment supporting it, is becoming increasingly sophisticated. Our platform spans cloud-native services, mobile and embedded AR, APIs, real-time collaboration and AI-powered data pipelines..

We're looking for an experienced Senior Security & Compliance Engineer to lead technical security across XYZ Reality and help shape how our security capability scales with the business.

Responsibilities

• This is a senior, high-impact role with genuine ownership and influence across the business.
• You'll sit within Engineering and work directly alongside the teams building our technology, taking part in architecture discussions, development workflows and technical decisions, rather than reviewing work after the fact.
• You'll own security architecture across our technology, embed shift-left practices into how we build, lead cloud and application security, and keep us ahead of both established and emerging threats. As our use of AI develops, you'll help us understand and respond to AI-related risks and attack vectors.
• Compliance remains an important part of the role. You'll help keep our security certifications current and support GDPR, data residency and enterprise customer requirements. We're looking for strong hands-on security expertise first, alongside the governance knowledge to work across both.
• The role is based in London on a hybrid basis, with 3 days per week in the office.
• What You’ll Be Doing
• Own security architecture and technical security across XYZ Reality's technology.
• Continuously assess our security posture and drive pragmatic, prioritised improvements.
• Lead cloud security across our infrastructure, including container platforms, databases and data pipelines.
• Own core security domains across identity, access, networking and data protection.
• Embed security testing and shift-left practices into engineering workflows and CI/CD.
• Partner with Engineering and Product on architecture, technical trade-offs and secure-by-design development.
• Run threat modelling and support secure coding practices across web, mobile and embedded codebases.
• Own vulnerability management, including triage, risk prioritisation, remediation tracking and incident response.
• Own and evolve security monitoring, detection and response.
• Assess emerging threats, including those tied to AI-enabled products and tooling.
• Help keep our security certifications current.
• Support compliance cycles, including controls testing, evidence gathering and auditor coordination.
• Support GDPR and data residency requirements across our infrastructure and data.
• Engage with enterprise customers and prospects on our security posture.
• Automate security controls and processes wherever possible.
• Shape the standards, tooling and operating model for security as the business scales.

Requirements

• Demonstrable in-depth hands-on technical security experience across application, cloud and/or infrastructure security.
• The confidence to own security decisions end-to-end, not only in an advisory or governance capacity.
• Strong cloud security experience with at least one major provider (Azure, AWS or GCP).
• Hands-on experience securing cloud-native and containerised environments.
• Experience integrating security testing into CI/CD pipelines.
• Experience securing infrastructure-as-code and GitOps workflows.
• Understanding of application and API security, including modern authentication standards and secure development practices.
• Experience identifying vulnerabilities, assessing technical risk and driving remediation.
• Comfortable writing automation in Python, Go, Bash or similar.
• Practical experience with recognised security certification frameworks.
• Current knowledge of the threat landscape, particularly AI-related threats.
• Strong communication skills with technical and non-technical stakeholders.
• A pragmatic, collaborative approach: you know great security enables engineering teams.
• Experience leading or scaling security within a high-growth or Series A/B technology business would be particularly valuable.
• Above all, we're looking for someone technically strong, curious and proactive, who engineers want to work with and who brings credibility to security conversations while staying pragmatic about how we build and ship.
• What You Could Be Working On
• Cloud and container security architecture
• Application and API security
• Secure software development and shift-left security
• Vulnerability management and incident response
• AI-related security and emerging threats
• Security certification and compliance
• Security automation and CI/CD integration
• Enterprise customer security requirements
• XYZ Reality's longer-term security roadmap

Benefits

• Lead technical security, with genuine ownership over how it develops at XYZ Reality
• Hybrid working from our London office
• 25 days annual leave + public holidays
• Private healthcare with Vitality
• Additional Christmas shutdown days
• Biannual salary reviews
• Summer & Christmas company events
• Free Thursday lunch and after-work gatherings
• Employee referral scheme
• Cycle to Work scheme
• If you're an experienced security engineer who wants to shape and lead security within a growing technology business, we'd love to hear from you.