Security Engineer

About the role

We are hiring a Principal Security Engineer / DevSecOps Lead to own the security posture of our SaaS platforms, cloud environments, and AI-enabled applications. This is a senior hands-on leadership role: you will design and drive the security architecture that protects a regulated, multi-tenant investment platform, embed automated security controls into how we build and ship software, and lead red-team-informed offensive testing that measurably reduces real risk. You will partner with SRE, platform, data, and application teams — and directly with the CISO to set the enterprise standard for secure development.

What you'll do

- Own security architecture for our SaaS platforms, multi-cloud environments (AWS, Azure), and AI-enabled applications, including LLM- and agent-based workloads.

- Build and operate a modern DevSecOps program: SAST, DAST, IaC scanning, SBOM/supply-chain (Sigstore, SLSA), secrets detection, container and Kubernetes admission control, and policy-as-code (OPA/Cedar).

- Design and run an automated vulnerability management program that prioritizes by exploitability and business impact, drives closure SLAs, and holds engineering teams accountable through metrics.

- Lead application security across the SDLC: threat modeling, secure design reviews, code review at critical seams, security champions program, and paved-road guardrails engineers actually adopt.

- Direct red-team and adversarial testing — internal exercises, purple-teaming, and third-party engagements — and translate findings into durable architectural fixes, not just tickets.

- Harden multi-tenant isolation, identity, and data protection for a regulated buy-side platform; own the security controls that map to SOC 2, SOX, and applicable regulatory obligations.

- Set the security-by-design bar for AI-enabled applications: prompt-injection defense, tool/agent boundary controls, model and data provenance, retention, and abuse monitoring.

- Partner with IT/AI Platform, SRE, and Data Governance on identity, secrets, network segmentation, logging, and incident response; participate in on-call for security incidents.

- Mentor senior engineers across security and platform; represent security in executive and board-facing risk reporting when required.

Required experience

- 10+ years in information security with deep hands-on DevSecOps and application security expertise; senior-leader scope but still writes code and shipped controls.

- Proven design and operation of security for SaaS platforms and cloud environments (AWS and/or Azure) at enterprise scale, including multi-tenant workloads.

- Strong background in automated vulnerability management and security testing — SAST/DAST/SCA, IaC/CSPM, container/K8s security, and SBOM/supply-chain tooling.

- Demonstrated red-team / offensive security experience: leading engagements, conducting or overseeing adversarial testing, and running purple-team exercises against real production systems.