Lead Security Engineer

Location: Any UK Office Hub: Bristol, London, Manchester, or Swansea; part-time remote working is available

Salary: £75,000–£100,000 per year

Company

hirify.global helps UK government and public sector organisations build better digital services and secure systems.

What you will do

• Own end-to-end technical security architecture across client engagements, including secure-by-default reference architectures for identity, networks, and data protection.
• Establish and lead risk-based vulnerability remediation programmes, including prioritisation, remediation SLAs, risk acceptance, and programme KPIs.
• Embed threat modelling, secure code review, SAST, SCA, dependency policies, and container scanning into agile engineering workflows.
• Design systems and controls aligned with NCSC Cyber Assessment Framework, GovAssure, Cyber Essentials, and the HMG Security Policy Framework.
• Communicate architectural and operational security risks to senior client stakeholders and coordinate detection, alerting, incident response, and security exercises.
• Mentor colleagues and client engineers while shaping hirify.global’s Cyber practice standards, hiring, and technical community.

Requirements

• Deep hands-on experience designing and building secure cloud architectures at scale using AWS, Azure, or GCP, including IAM, network segmentation, and data protection.
• Experience embedding security tooling and automation into CI/CD pipelines and engineering workflows across multiple teams.
• Strong proficiency in at least one programming or scripting language used to build production-grade security tooling.
• Experience with structured threat modelling such as STRIDE, MITRE ATT&CK, or attack trees, and with integrating SAST, SCA, dependency scanning, and container security into delivery pipelines.
• Eligibility for SC clearance requires five years of UK residency and a five-year employment history, or history back to full-time education.
• Ability to work from one of the UK office hubs, with occasional work outside standard hours during release, maintenance, or client operating windows.

Nice to have

• OSCP, OSWE, AWS, Azure, or GCP security certification, or CKS.
• Experience with vulnerability remediation at organisational scale using EPSS, KEV, CVSS, and asset criticality.
• Experience securing software supply chains through SBOMs, dependency provenance, and artifact signing.
• Experience with UK public sector security reviews, penetration testing, and cloud exposure management tooling such as AWS Inspector, GuardDuty, or Security Hub.

Culture & Benefits

• 30 days of paid annual leave.
• Flexible working hours and part-time remote working for all staff.
• Flexible parental leave and an individual benefits allowance for a healthcare cash plan or pension plan.
• Smart Tech and Cycle to Work schemes.
• Paid counselling plus financial and legal advice, with optional social and wellbeing events.