Principal Security Engineer

### **About the Role** We’re seeking a **Principal Security Engineer** with deep expertise in **application security, AI security,** and **security architecture** to join our growing security team. This role reports directly to the CISO. You’ll lead the design and implementation of scalable, secure systems across cloud platforms and modern application stacks — including AI-powered tooling — guiding both strategic security initiatives and day-to-day security engineering operations. This is a high-impact role that will shape the security posture of our platforms and development practices, working across engineering, DevOps, architecture, and compliance teams. ### **Responsibilities** **Core Security Engineering** - Design and implement secure architectures for applications, APIs, microservices, and containerized workloads. - Develop and enforce application security best practices across SDLC; partner with DevOps and engineering teams to integrate security into CI/CD pipelines. - Conduct threat modeling, security design reviews, and risk assessments for new and existing systems. - Evaluate and implement security tools, controls, and frameworks - Provide technical leadership and mentorship to security engineers, software developers, and DevOps personnel. - Lead response to complex security incidents or architectural flaws; conduct root cause analysis and recommend strategic remediations. - Contribute to and influence security policies, standards, and governance. - Stay current with emerging threats, vulnerabilities, and security technologies, advising stakeholders on evolving risks and mitigations. **AI Security** - Own the AI security program, including risk frameworks, threat models, and governance policies for AI/ML systems and LLM integrations. - Review new AI tool features and model updates for security risks prior to adoption, covering prompt injection, data leakage, model poisoning, and supply chain threats. - Track and apply industry guidance from NIST AI RMF, OWASP LLM Top 10, MITRE ATLAS, and CISA; translate standards into actionable internal controls and secure configuration baselines. - Embed AI security reviews into the feature development lifecycle, including pre-deployment red-teaming and adversarial testing of AI-powered features. - Monitor AI regulatory developments and advise on security and compliance implications for the organisation. **Requirements** **Required Qualifications** - 10+ years of experience in security engineering or architecture roles. - Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field from a reputable institution. - Deep expertise in cloud platforms (particularly AWS), including infrastructure-as-code (e.g., Terraform, CloudFormation). - Strong experience in secure software development and application security (e.g., OWASP Top 10, SAST, DAST, threat modeling). - Experience designing and implementing zero-trust architectures, secure API gateways, and identity/access controls. - Proficient in scripting or development languages (e.g., Python, Go, JavaScript) and secure coding practices. - Demonstrated leadership in cross-functional security initiatives and technical mentorship. - Hands-on experience assessing security risks of AI/ML systems, including familiarity with OWASP LLM Top 10, MITRE ATLAS, or NIST AI RMF. - Demonstrated ability to evaluate new AI tool features and vendor releases for security implications, and to produce clear risk assessments and secure configuration guidance. - Experience researching and applying industry security guidance, translating standards and frameworks into organisational controls and policies. **Preferred Qualifications** - Certifications such as CISSP, CCSP, AWS Security Specialty, GIAC (GCSA, GWEB, GDSA). - Familiarity with Kubernetes security, service mesh, and cloud-native security tooling. - Experience in regulated industries (e.g., fintech, healthcare, SaaS at scale). - Experience with AI red-teaming, adversarial ML, or LLM security assessment tooling. - Familiarity with secure configuration benchmarks for AI/ML platforms (e.g., AWS Bedrock). - Knowledge of emerging AI regulatory frameworks (e.g., EU AI Act, NIST AI RMF) and their security and compliance implications. *#LI-Hybrid* *#LI-SP1*