Staff Offensive Security Engineer

About This Opportunity

We are representing a confidential IoT platform company seeking a Staff Offensive Security Engineer to lead application security and vulnerability management programs across a complex, high-scale environment. This is a remote position based in London, England, United Kingdom.

Our client operates at the intersection of hardware, software, AI, and physical operations, processing trillions of data points annually across thousands of connected devices. The security team protects cloud services, internal systems, and firmware running on IoT hardware deployed globally.

This is a high-visibility role where you'll set technical direction for security programs while maintaining the ability to dive deep into critical focus areas as priorities evolve.

Responsibilities

• Lead strategy, operation, and continuous improvement of vulnerability management and core application security programs—defining processes, not just executing them
• Drive down mean time to remediate (MTTR) across vulnerability backlogs as SLAs tighten
• Build and champion automation and tooling that scale vulnerability detection and response across cloud, firmware/IoT, and corporate systems
• Set technical and architectural direction, translating strategic priorities into concrete execution plans
• Drive remediation by building trust with engineering teams and providing clear, actionable guidance
• Mentor engineers on secure design and remediation practices, serving as a technical authority
• Communicate risk and remediation tradeoffs to engineering leadership in actionable terms
• Participate in security incident investigations involving high-profile vulnerabilities
• Be regularly on call to support critical vulnerability response

What We're Looking For

Must-Have Qualifications:

• 10+ years of experience as a cloud engineer or security engineer, including hands-on vulnerability management across multi-product enterprise environments
• Proficiency in Go, Python, and JavaScript
• Demonstrated ability to independently set technical and architectural direction for security programs and drive remediation across broad environments without direct authority
• Significant experience with modern vulnerability management tooling (e.g., Wiz, Semgrep) and deep familiarity with CVSS and EPSS frameworks
• Strong AWS cloud services background
• Deep understanding of SAST, DAST, and SCA
• Hands-on use of AI/LLM tooling in security workflows (triage, detection logic, remediation drafting)
• Must be based in central or eastern UK timezones

Ideal Qualifications:

• Experience with C/C++, relevant to firmware and embedded systems
• Background at cloud-native, AI-forward companies building agentic or AI-driven products
• Experience with security automation platforms (e.g., Tines) and serverless frameworks (e.g., AWS Lambda)
• Experience integrating vulnerability management into CI/CD pipelines with shift-left mentality
• Experience spanning SaaS, firmware, and corporate IT security programs
• Experience managing vulnerabilities within FedRAMP-certified environments
• Experience building or extending AI copilots/agents for security workflows

How We Work With You

When you apply through Get A Job.ai, our talent team reviews your background and conducts an initial screening conversation. If there's a strong match, we submit your profile to our client for consideration. Throughout the process, we serve as your advocate and primary point of contact.

Important: Please apply only through Get A Job.ai. Do not attempt to contact the client directly, as all applications must come through our recruiting process.

Pay

The client has indicated an annual base salary range of £138,800–£173,500 GBP for this position, based on experience and qualifications. This role is also eligible for equity and performance-based compensation through the client organization.

Equal Opportunity

Get A Job.ai is committed to equal employment opportunity. We consider all qualified applicants without regard to race, color, religion, national origin, sex, gender identity, sexual orientation, disability, veteran status, age, or other protected characteristics.