Staff/Principal Security Engineer

About the Role

We’re seeking a Staff/Principal Security Engineer with deep expertise in application security, AI security, and security architecture to join our growing security team. This role reports directly to the CISO. You’ll lead the design and implementation of scalable, secure systems across cloud platforms and modern application stacks — including AI-powered tooling — guiding both strategic security initiatives and day-to-day security engineering operations.

This is a high-impact role that will shape the security posture of our platforms and development practices, working across engineering, DevOps, architecture, and compliance teams.

Responsibilities

Core Security Engineering

• Design and implement secure architectures for applications, APIs, microservices, and containerized workloads.
• Develop and enforce application security best practices across SDLC; partner with DevOps and engineering teams to integrate security into CI/CD pipelines.
• Conduct threat modeling, security design reviews, and risk assessments for new and existing systems.
• Evaluate and implement security tools, controls, and frameworks
• Provide technical leadership and mentorship to security engineers, software developers, and DevOps personnel.
• Lead response to complex security incidents or architectural flaws; conduct root cause analysis and recommend strategic remediations.
• Contribute to and influence security policies, standards, and governance.
• Stay current with emerging threats, vulnerabilities, and security technologies, advising stakeholders on evolving risks and mitigations.

AI Security

• Own the AI security program, including risk frameworks, threat models, and governance policies for AI/ML systems and LLM integrations.
• Review new AI tool features and model updates for security risks prior to adoption, covering prompt injection, data leakage, model poisoning, and supply chain threats.
• Track and apply industry guidance from NIST AI RMF, OWASP LLM Top 10, MITRE ATLAS, and CISA; translate standards into actionable internal controls and secure configuration baselines.
• Embed AI security reviews into the feature development lifecycle, including pre-deployment red-teaming and adversarial testing of AI-powered features.
• Monitor AI regulatory developments and advise on security and compliance implications for the organisation.

Requirements

Required Qualifications

• 7+ years of experience in security engineering or architecture roles.
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field from a reputable institution.
• Deep expertise in cloud platforms (particularly AWS), including infrastructure-as-code (e.g., Terraform, CloudFormation).
• Strong experience in secure software development and application security (e.g., OWASP Top 10, SAST, DAST, threat modeling).
• Experience designing and implementing zero-trust architectures, secure API gateways, and identity/access controls.
• Proficient in scripting or development languages (e.g., Python, Go, JavaScript) and secure coding practices.
• Demonstrated leadership in cross-functional security initiatives and technical mentorship.
• Hands-on experience assessing security risks of AI/ML systems, including familiarity with OWASP LLM Top 10, MITRE ATLAS, or NIST AI RMF.
• Demonstrated ability to evaluate new AI tool features and vendor releases for security implications, and to produce clear risk assessments and secure configuration guidance.
• Experience researching and applying industry security guidance, translating standards and frameworks into organisational controls and policies.

Preferred Qualifications

• Certifications such as CISSP, CCSP, AWS Security Specialty, GIAC (GCSA, GWEB, GDSA).
• Familiarity with Kubernetes security, service mesh, and cloud-native security tooling.
• Experience in regulated industries (e.g., fintech, healthcare, SaaS at scale).
• Experience with AI red-teaming, adversarial ML, or LLM security assessment tooling.
• Familiarity with secure configuration benchmarks for AI/ML platforms (e.g., AWS Bedrock).
• Knowledge of emerging AI regulatory frameworks (e.g., EU AI Act, NIST AI RMF) and their security and compliance implications.

#LI-Hybrid

#LI-SP1