Director, Security

About This Role

This Director of Security role involves owning security across a large portfolio of client-facing products that run on AWS and Azure, ship at high velocity, and extensively use AI and LLMs. This is a builder's role focused on designing security into architecture, delivery pipelines, and AI features, and leading the team responsible for maintaining it. The position requires deep thought on the security implications of products interacting with AI models, including prompt injection, data leakage, and AI-driven attacks.

Responsibilities

• Own the threat model for every AI/LLM-powered feature, covering prompt injection and prompt hijacking (direct and indirect), jailbreaks, system-prompt and data leakage, insecure output handling, excessive agency in tool-calling, and model denial-of-wallet
• Build adversarial evals and red-team exercises for AI features into the release process, with production monitoring for abuse and drift
• Govern internal AI use, including coding assistants, agents with repo or cloud access, plugin integrations and shadow AI
• Set a unified security architecture across AWS and Azure, including identity federation and guardrail policies
• Harden Kubernetes with admission control, network policy, workload identity and runtime threat detection
• Own edge security across every client-facing product, working with Architecture and Technical Operations on real-time tuning of DDoS mitigation thresholds, rate limits, bot-score and challenge thresholds, and WAF rule sensitivity, balancing attacks blocked against false positives for real customers
• Run an API security program covering inventory of every endpoint, authentication and authorization patterns, rate limiting and abuse detection
• Build paved roads so the secure way is the easy way
• Embed SAST, SCA, secrets and IaC scanning and SBOMs in CI/CD
• Secure the software supply chain, and lead design reviews and threat modelling as a peer to architects
• Own detection engineering and incident response across cloud, Kubernetes, edge and AI layers, including runbooks for AI-specific incidents, tabletop exercises and post-incident reviews
• Own the security tooling budget: build business cases, rationalise overlapping tools, negotiate with vendors and track spend against risk reduced
• Partner with Architecture and Technical Operations on tooling decisions from evaluation to rollout, and agree who owns which detection thresholds during a live attack
• Set direction for governance, risk and compliance, working with the in-house GRC team, which owns day-to-day delivery
• Ensure compliance with GDPR, PCI DSS and the EU AI Act is a byproduct of engineering controls, with automated evidence
• Make the calls on high-impact third-party risk, especially AI providers
• Scope and direct penetration tests and bug bounty, and represent security to enterprise clients on strategic deals