Technical Security Governance Lead - Application Security

WPP is the trusted growth partner for the world’s leading brands. 

We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company – powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth. 

We work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise.

Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow. 

For more information, visit WPP.com.

Why we're hiring

We are looking for a Lead Application Security Engineer to strengthen Secure Development across WPP.

Working within TSG, you will partner with software engineers, architects and product teams to establish practical security guardrails, help teams build the capabilities needed to meet them, and develop technical assurance that demonstrates whether those controls remain effective.

You will not own development pipelines, security tooling or software delivery. Instead, you will provide the technical leadership, evidence and challenge that helps engineering teams build security into the way they develop software and continuously improve their security practices.

Success requires strong technical credibility with engineers, a practical understanding of modern software development, and the ability to influence technical outcomes without direct authority.

The role sits within Technical Security Governance (TSG), reporting to the Director, Security Governance & Posture within the Group CISO organisation.

 What you'll be doing

• Act as WPP’s technical lead for Application Security, providing senior judgement on Secure Development, assurance and software-security risk.

• Understand how software is designed, built, tested and released across WPP, identifying where common guardrails and engineering capabilities will most improve security.

• Define practical Secure Development guardrails across secure design, threat modelling, coding, dependencies, software supply chains, CI/CD, cloud-native and AI-enabled development.

• Work directly with software engineers, architects and product managers to help establish the security capabilities and practices needed to meet those guardrails.

• Develop technical assurance capabilities that continuously demonstrate whether Secure Development controls are present, operating and effective.

• Use engineering evidence, security tooling and targeted validation to identify gaps, challenge assumptions and drive meaningful improvement.

• Help engineering teams understand recurring weaknesses and improve their own ability to identify, prioritise and address software-security risk.

• Provide evidence and technical challenge where controls are ineffective or risks remain, while keeping implementation and remediation ownership with the teams responsible for the software.

• Continuously evolve WPP’s Secure Development approach as engineering practices, technologies and threats change.

• Own Application Security Risk Factors through their lifecycle, raising and documenting issues, advising teams on remediation, tracking progress and challenging where exposure is not being addressed effectively.

What you'll need

Essential criteria:

• Strong practical understanding of modern software development and how security fits across design, development, testing, CI/CD and release.

• Meaningful experience in Application Security, Product Security, DevSecOps or Secure Development, with enough technical depth to work credibly with software engineers and architects.

• Ability to translate security expectations into practical engineering guardrails that teams can understand and implement.

• Strong communication and stakeholder skills, with the ability to work effectively with engineers, architects, product managers and senior management.

• Sound technical judgement, balancing security outcomes with engineering constraints and knowing when to challenge and when different approaches can achieve the same outcome.

• Ability to lead through technical credibility, evidence and influence rather than direct authority.

Nice to have:

• Previous hands-on experience in software development, software engineering, DevOps or a closely related engineering role; 5+ years would be particularly valuable.

• Experience establishing or improving Application Security, Secure Development or DevSecOps practices with engineering teams.

• Familiarity with common capabilities such as threat modelling, SAST, SCA, DAST, secrets detection, CI/CD security, API security or software-supply-chain controls.

• Experience using technology, automation or engineering evidence to provide security assurance at scale.

• Experience influencing technical decisions where security and delivery priorities compete.

• Security Champions, paved roads, developer enablement or similar experience.

• Cloud-native, SaaS or highly distributed application experience.

• AI-enabled application or AI-assisted development security experience.

• OWASP SAMM, ASVS, NIST SSDF, SLSA or similar frameworks.

We believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process.

WPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers.

Please read our Privacy Notice (https://www.wpp.com/en/careers/wpp-privacy-policy-for-recruitment) for more information on how we process the information you provide.