What you’ll own:

• The security posture of the production AWS environment, including IAM, VPC, Secrets Manager, ECS, Aurora and access controls
• Identity and access management across the business, including Cloudflare Zero Trust
• Security within the engineering lifecycle, from threat modelling and secure design reviews through to vulnerability management and secure development practices
• CI/CD and software supply-chain security, including dependencies, GitHub Actions, build provenance and container security
• Security monitoring, penetration testing, incident response and remediation
• The SOC 2 programme, including controls, evidence gathering, audits and ongoing improvements
• UK GDPR and PECR compliance, including DPAs, sub-processors, processing records and privacy requirements
• Customer security reviews, enterprise questionnaires, vendor assessments and security due diligence
• The full security incident lifecycle, including response, notifications, post-incident reviews and making sure lessons turn into action

What we’re looking for:

You’ll have deep, hands-on experience securing production AWS environments, particularly across IAM, networking, containers and databases.

You’ll also bring:

• Strong Terraform and infrastructure-as-code experience
• Excellent application, cloud and infrastructure security knowledge
• Experience securing CI/CD pipelines and software supply chains
• A solid understanding of vulnerability management and incident response
• The ability to make sensible, commercial decisions about risk
• The confidence to work autonomously while building strong relationships with engineering teams
• A bias towards solving problems, not simply identifying them
•