Lead Security Engineer

Qualifications

• Education: Bachelor's degree required in Computer Science, Cyber Security, Software Engineering or a related technical discipline. A Master's degree is preferred.
• Core Experience: Indicative range [8 or more years] of progressive engineering experience, with demonstrated depth in either the defensive or offensive discipline and strong working fluency across both.
• Cross Discipline Credibility: hands on seniority in application security, cloud architecture defence, penetration testing or security operations, with the range to speak authoritatively across the wider function.
• Cloud, DevOps & Exploitation Stack: deep practical knowledge spanning public cloud topologies, containerisation and orchestration, GitLab CI pipelines, and manual testing and forensic tooling.
• AI & Regulatory Mastery: expert level understanding of the OWASP Top 10 for LLMs, applied cryptography and federated authentication architectures, together with practical experience aligning controls to PCI-DSS (v4.0), SOC 1, SOC 2 and DORA.
• Leadership Track Record: prior experience mentoring engineers, shaping technical roadmaps or influencing hiring and resourcing decisions within a security or engineering function.
• Cloud & Architecture: AWS Certified Security - Specialty, CKS or CISSP.
• Hands-On Offensive & Red Team: OSCP, OSCE or SANS GXPN.
• Incident Response & Defence: GCIH or GCFA.
• Modern AI Security: OffSec OSAI (Offensive Security AI Red Teamer).
• Moves credibly between builder and breaker mindsets, equally comfortable setting defensive architecture standards and directing offensive assurance work.
• Leads with influence rather than authority alone, able to prioritise competing security priorities and represent them clearly to executive stakeholders.
• Brings calm, analytically clear decision making under pressure and uses that same clarity to coach senior and junior engineers through complex incidents.
• Resilience and analytical clarity in high-pressure scenarios, setting the standard for transparent communication and directing risk-based decisions across the team during active security incidents or compressed financial product launch windows.
• Balances technical risk reduction with business enablement, owning security infrastructure as a competitive advantage that unblocks global revenue and enterprise-client acquisition across the wider business.