Engineering Manager, Security & Platform

Engineering Manager, Security & Platform

The Role

Lyrebird holds clinical data for thousands of clinicians across Australia and the UK, and that data is the thing we protect above all else. This role exists to take a strong SRE foundation and turn it into a standing capability across security, platform, reliability, and data, one that scales with the business instead of trailing behind it. You'll define how Lyrebird builds security and reliability into everything we ship, not as a gate that slows people down, but as the default path that makes the safe way the easy way.

You thrive here if you're a paranoid optimist: someone who hunts for what could go wrong and then builds the thing that makes it not go wrong. You have high agency, you see a problem and you fix it, full stop, and you're just as comfortable in the code as you are setting direction for a team across two countries. You care deeply about what this work protects: real clinical data, real clinicians, real patients. If you want a slide deck role, this isn't it.

About Us

Every day in Australia, 10 people die from preventable medical errors, not from incurable diseases, but from misdiagnosis, missed information, and clinicians making decisions under impossible pressure. At the centre of that failure is a doctor spending 40% of their day on paperwork instead of patients. Lyrebird is fixing that.

We turn real clinical conversations into accurate notes, automatically, backed by ambient real time document creation, intelligent document management and clinical workflow automation, native patient data integrations across siloed health systems, and a patient and clinical communications layer.

Thousands of clinicians across multiple disciplines use Lyrebird every day in environments where accuracy, safety, and time matter deeply.

We're growing fast across Melbourne, the UK, and Asia, and there's a finite window right now to set the standard for clinical AI in Australia before anyone else does.

What you'll do

• Define security as a continuous capability, not an audit, folding threat modelling, authn/authz, secrets management, and vulnerability management into the design flow itself

• Build a security control plane that lives in CI/CD: gates, scanning, and golden paths, so security is produced by the system rather than inspected in after the fact

• Set a standing pen-test and red-team cadence with a security-finding SLA, turning audits into checkpoints on a capability rather than the capability itself

• Own PHI protection end to end, encryption, access control, and provable data residency across AU and UK, and make it auditable: what happened to clinical data, who touched it, and what the AI generated and why

• Shape the AU and UK regulatory surface as a standing capability that unblocks enterprise sales rather than slowing it down

• Define a single golden path for build, test, deploy, and observe that every engineer across both countries ships on, deliberately homogeneous, not two divergent stacks

• Set SLOs and error budgets that turn reliability into a number the whole business can see

• Own incident tooling and process, and run real disaster recovery drills with measured RPO/RTO, not backups that only exist on paper

What you'll bring

• A track record building security and platform capabilities in a regulated, sensitive-data environment, where you understand that a confidently wrong output or a data-residency slip is worse than an outage

• An instinct for making the safe path the easy path, with paved roads you've built that engineers actually chose to use, not gates that made you the bottleneck

• Genuine depth in at least one of application/cloud security, platform/DevEx, or SRE/reliability, and real competence across the other two

• Comfort working with legacy systems through strangler-fig and harden-at-point-of-change, with an allergy to big-bang rewrites

• Regulatory fluency across AU and/or UK: GDPR/ICO, NHS DSP Toolkit, DTAC, SOC 2, or ISO 27001

Nice to have

• Exposure to AI/LLM product surfaces and the specific risks they introduce

• Experience working across distributed teams in multiple countries

• Direct experience in HealthTech or another environment where clinical or highly sensitive data was the core asset

• A history of being hands-on well past the point most managers stop writing code

Every control you build, every drill you run, every golden path you define is standing between a clinician's data and the people who'd misuse it. This isn't compliance theatre. It's the reason thousands of clinicians can trust Lyrebird with the most sensitive moments of their patients' care.

We're building a team that reflects the diversity of the people who benefit from our work. We want Lyrebird to be a place where everyone feels safe, supported, and able to thrive. If you're from an underrepresented background in tech, we strongly encourage you to apply, even if you don't meet every requirement.