What you'll be doing

• Shape secure architecture from day one by partnering with teams early in design and leading security design reviews.
• Build security harnesses for human and AI-agent development, including guardrails, sandboxing, least-privilege access, secrets handling, and automated checks.
• Lead on AI and agentic security, defining secure patterns for LLM integrations and mitigating risks like prompt injection and data leakage.
• Create paved roads by publishing reusable patterns, reference architectures, and standards that are easy for teams to adopt.
• Scale threat modelling by enabling engineers to run threat models themselves and perform internal security assessments.
• Remove whole classes of vulnerabilities through automation, root cause analysis, and feedback into patterns and guardrails.
• Turn security risk into clear, pragmatic decisions to help the business prioritize based on risk and value.
• Advise and enable engineering, product, and leadership teams; coach engineers; evaluate third-party and AI tools; and support ISO 27001/27701 compliance.

Requirements

• 7+ years in security engineering, application/product security, or security architecture with hands-on experience securing cloud-native systems.
• Deep knowledge of Secure SDLC including threat modelling, security testing, app security review, and CI/CD security.
• Hands-on experience with AWS and Cloudflare (or equivalents) and Terraform or similar infrastructure as code tools.
• Strong grasp of the OWASP Top 10 and ability to assess exploitability and impact.
• Solid coding skills (Python, Go, Scala) and experience building security tooling or automation.
• Practical understanding of risks in AI-assisted and agentic development and LLM applications.
• Experience with security risk analysis and risk management methods.
• Ability to clearly explain trade-offs and win support among engineers and senior stakeholders.

Nice to have

• Experience building guardrails, sandboxes, or policy-as-code (e.g., OPA) for developer platforms or AI coding agents.
• iOS or Android security experience.
• Experience with ISO 27001, ISO 27701, or SOC 2 audits.
• Background in health tech, femtech, or other regulated, privacy-sensitive industries.
• Certifications or degrees such as CISSP, CCSP, OSCP, or MSc in Information Security.

Perks and benefits

• Competitive salary with annual reviews and performance incentive scheme participation.
• Paid holiday, sick leave, and female health leave.
• Enhanced parental leave and pay for maternity, paternity, same-sex, and adoptive parents.
• Accelerated professional growth supported by world-changing work and learning opportunities.
• Hybrid work model with 3 days per week in the office for in-person collaboration.
• 5-week fully paid sabbatical at 5-year anniversary.
• Flo Premium subscription for friends and family, plus additional health, pension, and wellbeing perks.