Lead / Associate Lead Security Engineer

We are seeking a motivated and detail-oriented Lead / Associate Lead Security Engineer to join our Cyber Security team in Colombo, Sri Lanka.

As a Lead / Associate Lead Security Engineer,

you will provide technical leadership for security engineering across the organisation. You will set technical direction, own critical security capabilities, drive cross-team security initiatives, and mentor engineers at all levels. You are accountable for the maturity and effectiveness of security engineering, balancing risk, delivery, and engineering realities.

This is a technical leadership role, not a people-management role—though it carries significant influence and mentorship responsibility.

Duties and Accountabilities

Technical Strategy & Ownership

• Define and drive the technical direction for security engineering
• Own critical security domains and capabilities end-to-end (AppSec, CloudSec, CI/CD security, vulnerability management)
• Set standards, patterns, and guardrails that scale across teams
• Make and own high-impact, risk-based security decisions

Cross-Team Leadership

• Lead security initiatives spanning multiple engineering teams
• Act as the senior security point of contact for engineering leadership
• Influence architecture and design across the organization
• Align security efforts with business and delivery priorities

Engineering & Automation

• Drive security automation and tooling strategy (SAST, SCA, DAST, IaC, container security)
• Improve signal quality, coverage, and developer experience
• Ensure security platforms are reliable, scalable, and maintainable

Risk, Incident & Compliance

• Lead response and root-cause analysis for significant security incidents
• Identify systemic risks and drive long-term remediation
• Own security engineering input into compliance efforts (ISO 27001, SOC 2, FedRAMP)
• Coordinate external engagements (e.g. penetration testing vendors)

Mentorship & Capability Building

• Mentor engineers and emerging leads (including Associate Security Leads)
• Raise the overall security capability of engineering teams
• Champion a strong, pragmatic security culture

What Success Looks Like

• Security engineering direction is clear, pragmatic, and adopted
• Critical risks are proactively identified and addressed
• Engineering teams trust and act on security guidance
• Security maturity improves measurably across the org
• Engineers grow under your mentorship

Required Skills & Experience

• Typically 5+ years in security engineering, software engineering, or platform engineering
• Proven track record owning security capabilities or programmes at scale
• Deep expertise across multiple domains (AppSec, CloudSec, CI/CD security, Architecture)
• Strong hands-on engineering and automation background
• Demonstrated technical leadership and cross-team influence

Scope & Expectations

• Technical leadership role, accountable for security engineering outcomes
• Owns strategy and direction, not just delivery
• Expected to influence without formal authority
• Expected to challenge unsafe designs and decisions
• Not a people-manager role (unless explicitly combined)

Nice to Have

• Experience leading security in an enterprise product environment
• Track record influencing engineering-wide standards
• Experience mentoring senior engineers and leads
• Relevant advanced certifications (not mandatory)

Core Required Qualifications

• Demonstrated experience in security engineering with hands-on involvement in automated security solutions.
• Working knowledge of DevSecOps principles and practices.
• Practical experience with CI/CD tools (e.g., Bitbucket, Jenkins, GitLab, GitHub Actions, or equivalent).
• Proficiency in security platforms, vulnerability management tools, and at least one scripting language (e.g., Python, Bash).
• Solid understanding of common vulnerabilities (e.g., OWASP Top Ten) and remediation approaches.
• Strong communication and collaboration skills with ability to engage cross-functional teams.
• Familiarity with containerisation tools (e.g., Docker, Kubernetes).
• Knowledge of security standards (e.g., NIST, ISO 27001, CIS).

Preferred Qualifications

• 5+ years of experience in security engineering, software engineering, or platform engineering.
• Proven track record owning security capabilities or programmes at scale.
• Deep expertise across multiple security domains (AppSec, CloudSec, CI/CD security, Architecture).
• Advanced proficiency in security automation, tooling strategy, and infrastructure-as-code security.
• Demonstrated technical leadership and ability to influence cross-team decisions without formal authority.
• Experience leading security incident response and root-cause analysis.
• Track record mentoring engineers and emerging security leads.
• Experience influencing engineering-wide security standards and practices.
• Relevant advanced certifications (e.g., CISSP, CCSK, or equivalent).

We embrace flexibility and hybrid work opportunities to support diverse needs and lifestyles, while also valuing inclusive workplace experiences. By fostering a sense of community, we drive innovation, strengthen connections, and nurture belonging. Our commitment ensures you can work in a way that suits you best, while also engaging with colleagues to share ideas and build meaningful relationships.