Head of Security

The candidate will have responsibilities across the following functions:

Application Security:

• Own and manage the secure SDLC, including threat modelling, security design reviews, and secure coding standards.
• Integrate security tools into CI/CD pipelines, including SAST, DAST, SCA, secrets scanning, and Infrastructure-as-Code (IaC) scanning.
• Lead product vulnerability management, including vulnerability triage, remediation SLAs, penetration testing, and responsible disclosure programs.
• Ensure security across multi-tenant SaaS platforms, covering tenant isolation, authentication, authorisation, API security, and data protection.
• Secure AI and LLM-based features against prompt injection, data leakage, and model-related risks.
• Collaborate with engineering leaders to integrate security practices into development workflows.
• Support SOC 2 and ISO 27001 compliance requirements and customer security reviews in coordination with the GRC team.

Security Operations and Incident Response:

• Lead the in-house Security Operations Centre (SOC) team and manage external MDR partnerships, including service scope and SLAs.
• Oversee 24/7 security monitoring, alert triage, escalation, and incident response operations.
• Lead detection engineering, including SIEM and EDR tools, logging strategies, detection rules, and alert optimisation.
• Develop and maintain incident response playbooks, severity levels, on-call processes, and post-incident review procedures.
• Lead security incidents from detection and containment through eradication, recovery, and customer or regulatory notifications.
• Conduct regular tabletop exercises, red team assessments, and purple team drills.
• Manage threat intelligence and threat-hunting activities across cloud, corporate, and product environments.

Corporate Security:

• Oversee corporate IT security, including identity and access management, SSO, MFA, device management, endpoint protection, and email security.

Requirements:

• 6+ years of experience in cybersecurity or information security.
• Proven experience leading responses to high-severity security incidents, including data breaches, ransomware, account takeovers, cloud compromises, and critical vulnerabilities.
• Strong application security experience, including building secure SDLC programs within SaaS environments and conducting architecture and code reviews.
• Experience managing in-house SOC teams and external MDR/MSSP providers, including SLA management.
• Strong knowledge of SIEM, SOAR, EDR/XDR, and cloud-native security monitoring tools.
• Hands-on experience with cloud security, preferably AWS, including GuardDuty, CloudTrail, and Security Hub.
• Experience securing corporate IT infrastructure, identity systems, and endpoint environments.
• Working knowledge of MITRE ATT and CK, OWASP Top 10, OWASP ASVS, and NIST incident response guidelines.
• Strong incident management, communication, and stakeholder management skills, with the ability to brief both technical teams and executive leadership.
• Ability to remain calm and make effective decisions during critical security incidents.

Nice to Have:

• Experience working in B2B SaaS, cybersecurity, or compliance-focused organisations.
• Relevant certifications such as GCIH, GCIA, OSCP, OSWE, or CISSP.
• Knowledge of digital forensics and investigation techniques.
• Experience securing AI- and LLM-based products.

Skills

EDR, Incident Response, SIEM, SOAR, SOC, Security, XDR