Lead Security Engineer

Key Responsibilities

• Own end-to-end technical security architecture across engagements. Design secure-by-default reference architectures set patterns for identity network and data protection and maintain living technical standards feeding directly into how teams build not just how theyre audited.
• Lead vulnerability remediation as an engineering programme. Define the prioritisation framework drawing on EPSS KEV CVSS and asset criticality set remediation SLAs own the risk-acceptance register and drive fixes directly into delivery backlogs alongside product teams. Report programme KPIs (MTTR by severity backlog age coverage recurrence rate) to senior stakeholders.
• Drive security into the teams normal engineering rhythm. Embed threat modelling secure code review SAST SCA dependency policy and container scanning into design and delivery cycles building the tooling and automation that make this the default not a specialist handover at the end of a sprint.
• Navigate UK government security standards with confidence as an engineer not a paperwork exercise. Design systems and controls that satisfy the NCSC Cyber Assessment Framework GovAssure Cyber Essentials and HMG Security Policy Framework applying them proportionately across engagements as guardrails that enable safe delivery not barriers to it. Engage with government security communities and coordinate with departmental technical teams.
• Communicate security risk in terms that drive engineering decisions. Report system posture remediation programme performance and architectural risk to senior client stakeholders tailoring the frame for the audience and structuring reports around the decisions the reader needs to make not just the findings.
• Set the standard for incident response and detection engineering. Build and drive adoption of detection alerting and IR tooling across engagements own the IR-to-vulnerability-management feedback loop and coordinate cross-team exercises including known-exploited-vulnerability scramble drills.
• Grow the people around you. Mentor colleagues across the practice and at client organisations pair on complex or unfamiliar engineering problems and create structured development opportunities including for client engineers who may not yet have strong security habits.
  
  
• Contribute to Made Techs Cyber practice beyond delivery. Shape practice standards contribute to hiring and technical calibration build and share expertise externally and help grow a security engineering community that raises capability across the organisation.

Skills Knowledge & Expertise

• Deep hands-on experience designing and building secure cloud architectures (AWS Azure or GCP) at scale including IAM network segmentation and data protection patterns.
• Proven track record embedding security tooling and automation into CI/CD pipelines and engineering workflows across multiple teams.
• Strong proficiency in at least one programming/scripting language used to build production-grade security tooling (not just scripts).

• OSCP OSWE or equivalent offensive security credential
• AWS/Azure/GCP security specialty certification
• CKS (Certified Kubernetes Security Specialist)

• Experience establishing and operating vulnerability remediation programmes at organisational scale including risk-based prioritisation using EPSS KEV and asset criticality and driving fixes across multiple delivery teams.
• Evidence of designing systems that satisfy UK government security frameworks GovAssure CAF Cyber Essentials HMG Security Policy Framework in a complex multi-supplier or multi-team environment as an architect rather than an assessor.
• Experience conducting or coordinating technical security reviews and penetration testing in UK public sector contexts including remediating findings and briefing senior technical stakeholders.
• Working knowledge of exposure management beyond CVE-only approaches incorporating misconfiguration identity exposure and attack-path analysis using cloud-native tooling (AWS Inspector GuardDuty Security Hub or equivalents).
• Experience securing software supply chains SBOM generation dependency provenance artifact signing and integrating this into build pipelines rather than a standalone assurance process.
• Experience building or shaping security engineering capability within a consultancy programme delivery or multi-client environment including growing technical skills in colleagues and client teams.
• Evidence of acting as a trusted technical adviser to senior client stakeholders anchoring recommendations on engineering outcomes challenging briefs constructively and making security value visible through what gets shipped.
• Experience setting team ways of working in iterative delivery environments establishing retrospective cadences collaborative problem-solving norms and pairing practices that spread security knowledge across the team.

• Deep familiarity with structured threat modelling approaches STRIDE MITRE ATT&CK attack trees and experience embedding these into agile delivery ceremonies.
• Experience integrating SAST SCA dependency scanning and container security tooling into CI/CD pipelines as part of a shift-left security approach including building custom tooling where off-the-shelf doesnt fit.
  
  

Job Benefits