About the Role
We are seeking a Principal DevSecOps Engineer who is ready to lead and define our security engineering organisation. You will be the founding architect for our security engineering organisation. This is a hands-on building role. You'll treat security as an engineering challenge, not just a compliance exercise.
As we prepare for a future where thousands of autonomous agents collaborate on business tasks, we face complex and emerging cybersecurity threats. You will lead from the front, defining our governance and cybersecurity strategy at the same time as contributing production code to ensure our software is secure by design. You will be the technical authority on how we securely embed agentic workflows, spanning AWS and Google Cloud as well as multiple LLM providers, into the heart of our operations.
What You Will Do
* Architect Secure Agentic Workflows: Design and implement robust identity and access management (IAM) frameworks for multi-agent systems. You will ensure that as we scale to thousands of agents, every entity has a unique, verifiable digital identity with scoped, short-lived permissions.
* Lead AI Software Governance: Establish clear standards and controls to monitor and manage how AI tools influence our software development lifecycle. You will set the \"Reviewer-First\" standards for validating AI-generated code and preventing \"Shadow AI\" within the engineering team.
* Build Security Primitives: Enable other teams by designing default, reusable security patterns, such as approved libraries and service blueprints, that make secure implementation the default for all developers.
* Multi-Cloud Engineering: Own the security posture across our heterogeneous cloud environments (AWS and GCP), focusing on workload identity, securely connecting services, and network isolation using tools like VPC PrivateLink and Managed Virtual Networks.
* Advanced Incident Response: Lead investigations into high-severity incidents, specifically those involving emerging AI threats (e.g., prompt injection, data poisoning, or autonomous agent deviations).
* Lead with AI Tools: Champion the use of AI coding assistants (e.g., Cursor, Claude Code) while implementing the necessary guardrails, such as commit-level risk scoring and automated testing gates, to protect against AI-introduced vulnerabilities.
Technologies You Will Use
* Cloud Infrastructure: AWS, Google Cloud Platform (GCP).
* Agentic Protocols: Model Context Protocol (MCP), Anthropic/Claude API.
* Identity & Security: Microsoft Entra Agent ID, OAuth2, OIDC, mTLS, HashiCorp Vault.
* Automation & IaC: Terraform, GitHub Actions, Open Policy Agent (OPA).
* Programming: Python, Go, or TypeScript.
What You Bring
* Strong Technical Foundation: Deep computer science and programming expertise with the ability to modify production code in complex backend environments.
* Extensive Experience: Typically 12+ years in security or software engineering, with a proven track record of defining the company's long-term security strategy and vision.
* AI Expertise: Significant experience in securing AI/ML systems, including threat modelling for large language models (LLMs) and designing human-in-the-loop (HITL) oversight models.
* System Design & Policy: The ability to translate high-level business risks into automated security controls via policy-as-code.
* Crisis Leadership: A calm, analytical approach to security breaches, with the ability to conduct forensic analysis on cloud logs and agent traces.
* Curiosity & Mentorship: A commitment to staying current with the AI threat landscape and a desire to mentor the next generation of security-minded engineers.