Lead DevSecOps Engineer

Overview

In this role, you lead security for AI-driven products and platforms at AECOM, guiding security from design to production. You will own AI/LLM security, oversee vulnerability remediation, and drive secure delivery with engineers. You’ll shape threat modeling, incident response, and security tooling to minimize risk while maintaining velocity. This position offers impact at scale within a global, innovation-driven infrastructure firm.

Pay / Benefits

• medical
• dental
• vision
• life
• AD&D
• disability benefits

Responsibilities

• Lead security reviews of new products from design to launch using threat modelling to assess architecture and data flows
• Own security for AI and LLM features, define guardrails and testing approaches against risks like prompt injection and data leakage
• Secure AI supply chain by assessing third-party models and data used for training and retrieval
• Hold security sign-off authority with risk-based release criteria for product changes
• Manage CVE remediation across code, dependencies, containers, and cloud infrastructure
• Maintain and tune CI/CD security scanning (SAST, SCA, secrets, container, IaC) and provide actionable feedback
• Oversee penetration testing program, scope engagements, coordinate with external testers, track remediation
• Strengthen cloud and identity security across Azure and GCP (IAM, networking, secrets management)
• Lead incident response and post-incident reviews, keep runbooks up to date
• Establish security champions program across engineering teams

Key requirements

• Hands-on experience in security engineering, application or product security, DevSecOps, or related roles with technical leadership
• Proven experience leading security reviews and threat modelling with sign-off authority
• Strong vulnerability management and incident response experience including CVE triage and remediation across code, containers, and cloud
• Hands-on experience maintaining security scanning tooling in CI/CD (SAST, SCA, secret, container, IaC) with GitHub Actions and Terraform
• Experience managing end-to-end penetration tests (scoping, vendor coordination, remediation)
• Solid understanding of cloud security in Azure and/or GCP (IAM, networking, secrets management)
• Ability to explain risk clearly and influence engineers, product owners, and leaders
• Track record of working in fast-moving teams and large global organisations with governance
• Experience securing AI/ML and LLM-based applications (preferred)
• Experience with security/compliance frameworks (NIST, CIS, ISO27001, SOC 2) and relevant certifications (OSCP, CISSP, GWAPT) (preferred)

• Effective communication of risk to engineers and leadership
• Influencing without formal authority
• Decision-making under pressure and fast-paced environments
• Threat modelling
• CVE management and remediation
• SAST/SCA/secret scanning and IaC security

Full job description from WhatJobs. Apply for this role →