Senior Cybersecurity Lead Analyst

Hands-on Senior Cybersecurity Lead to drive application, product, and offensive security across our cloud platforms. You will lead penetration testing, application security, and vulnerability management; embed Secure SDLC/DevSecOps with engineering; secure and govern AI-enabled capabilities; and communicate security risk clearly to technical and business stakeholders. This role sets security practices, mentors others, and raises the security posture of Platform Services.

Key Responsibilities

• Lead application & product security across internal and cloud-based apps; drive Secure SDLC / DevSecOps with engineering.
• Own penetration testing for web, API, cloud, and infrastructure – scope, test, report, track remediation, retest.
• Run vulnerability management with risk-based prioritisation (exploitability, exposure, impact, asset criticality) and remediation to closure.
• Provide cloud security guidance for AWS and/or Azure – review IAM, network, logging, encryption, and CI/CD security.
• Integrate security testing and automation into CI/CD; improve secure-coding practices and tooling.
• Secure & govern AI: control and monitor AI/LLM and AI-assisted development risk across the platform (see AI Security & Governance below).
• Review designs to catch risk early (architecture/design reviews, threat modelling).
• Lead & collaborate: mentor security staff, act as SME, and partner with Engineering, DevOps, Architecture, and Product.
• Governance: support ISO 27001 / SOC 2 controls, audits and evidence, and security metrics/reporting.

AI Security & Governance

• Establish how AI-related risk is identified, secured, and continuously monitored across AI/LLM-enabled features and AI-assisted development in Platform Services.
• Define and enforce security controls and governance for AI/LLM-enabled applications and AI-assisted development tools.
• Identify and mitigate AI-specific risks: sensitive-data and source-code exposure, prompt injection, insecure or hallucinated output, excessive tool/agent permissions, model and supply-chain risk, and IP/licensing exposure.
• Apply least-privilege access for AI tools and agents, tool allowlists, retrieval/data-loss controls, and input/output validation.
• Continuously monitor and log AI usage, prompts, and agent actions; set alerting, anomaly detection, and human-oversight/escalation for AI-driven workflows.
• Align AI usage with responsible-AI and governance frameworks (e.g., ISO/IEC 42001, NIST AI RMF) and provide evidence for audits and customer assurance.