About This Role
Shaping how secure digital products are built at Hilti is the core of this role, by integrating cybersecurity throughout the robust software development lifecycle. This position will turn security into a practical engineering advantage—embedding effective controls, validating vulnerabilities, and scaling automation so teams can innovate and deliver with speed and confidence.
Responsibilities
- Collaborate with product, development, and DevOps teams to ensure software and AI-enabled capabilities are built and deployed securely without compromising agility and speed
- Perform security assessments of web applications, APIs, and AI-enabled capabilities, including code review, dynamic testing, LLM security testing, and agent or tool-use testing
- Conduct threat modelling and security architecture reviews for cloud-native, web, API, and AI solutions
- Build and operate security automation and AI-enabled capabilities, including automated threat modelling, remediation support, and MCP-based capabilities for engineering teams
- Scale security as a developer experience through self-service tooling, APIs, clear standards, implementation guidance, security champions, and CI/CD-native controls
- Manage and validate remediation of vulnerabilities, and support penetration testing and broader security testing programmes
- Configure and optimize preventive controls such as web application firewalls, bot protection, rate limiting, identity controls, secrets management, and data protection
- Develop security monitoring, alerting, metrics, and incident response capabilities to address security issues and cross-team dependencies
- Assess and integrate open-source and vendor security tools to automate and scale security processes
- Engineer and secure cloud-native solutions across AWS, Azure, or GCP using containers, serverless patterns, event-driven messaging, and distributed data stores
Requirements
- 5+ years of relevant experience in application security, product security, security engineering, DevSecOps, or security operations, including hands-on experience onboarding or optimizing security tools
- Strong understanding of vulnerability management, network security, cloud security, secure engineering practices, and compensating controls
- Hands-on experience with at least one major cloud platform such as AWS, Azure, or GCP, including identity, networking, secrets management, data protection, and logging
- Software engineering and automation skills, with the ability to read and write Python, Go, PowerShell, or a similar language and work credibly with engineering teams
- Experience securing CI/CD pipelines and scaling security through developer-friendly tools, APIs, automation, and self-service platforms
- Working knowledge of GenAI and LLM security, including prompt injection, model and data integrity, agent and tool-use security, and AI supply-chain considerations
