Lead Security Engineer

The role

The Lead Security Engineer will own and mature how Encord secures its people, identities, devices, and SaaS and AI tools. You will build and run controls, own the organization security programme, and act as the security expert across the company.

What you will do

• Own identity and access including SSO, MFA, conditional access, and automated joiner/mover/leaver processes.
• Manage device security for the macOS fleet through MDM and EDR.
• Run SaaS and AI security by discovering shadow IT, reviewing app permissions, and assessing new tools.
• Protect executives and high-risk users from targeted phishing, impersonation, and AI-enabled fraud.
• Act as technical owner of ISO 27001 and SOC 2 controls.
• Lead third-party and vendor risk assessments.
• Respond to and lead security incidents.
• Partner with DevOps and Platform to secure the cloud environment.
• Write clear policies and runbooks.

Required qualifications

• Around 7–8 years of hands-on security experience, with a strong focus on organisation security.
• Experience rolling out or re-architecting SSO, MFA, and conditional access across a company.
• Experience deploying and managing MDM and EDR across a macOS fleet.
• A track record of building automated joiner/mover/leaver flows and user access reviews.
• Experience running SaaS security, including discovering shadow IT, reviewing app permissions, and assessing new tools before adoption.
• Experience putting guardrails around AI tool usage, such as approved tool lists, data handling rules, and vendor reviews of AI providers.
• Ownership of, or significant contribution to, ISO 27001 and/or SOC 2 audits, including policies, control evidence, and auditor walkthroughs.
• Experience defending against targeted phishing and business email compromise.
• Experience leading or supporting security incidents such as phishing compromises, account takeovers, or lost devices.
• Experience running third-party and vendor risk assessments and advising on the security of new tools before they're adopted.
• Experience partnering with DevOps/Platform teams to secure cloud environments (ideally GCP), including IAM, network segmentation, secrets management, logging, and CSPM.
• A habit of writing policies and runbooks that people can easily follow.

Nice to have

• Experience with Infrastructure-as-Code (e.g. Terraform).
• Experience owning vulnerability management across infrastructure, including scanning, prioritisation, remediation tracking, and SLAs.
• Experience building and improving detection and monitoring, centralising logs into a SIEM and defining meaningful alerts.
• Experience implementing and tuning SAST, DAST, SCA, and secrets scanning in CI/CD pipelines.
• Experience coordinating external penetration tests and bug reports, and driving fixes to closure with engineering teams.
• Experience helping engineers write secure code through guidance, patterns, and lightweight training.
• Experience supporting sales and customer trust by answering security questionnaires and joining customer security calls.
• Familiarity with executive digital protection, such as OSINT footprint reviews, impersonation monitoring, and out-of-band verification for sensitive requests.

Benefits

• Competitive salary, commission, and meaningful equity
• Clear, accelerated growth opportunities
• Strong in-person culture: 4 days/week
• Daily team lunches & dinners
• Annual learning & development budget
• Comprehensive health, dental, and vision coverage
• US employees: 18 paid vacation days plus US public holidays
• UK employees: 25 paid vacation days plus UK public holidays
• Frequent travel opportunities across the U.S., London, and Europe
• Bi-annual company offsites & monthly socials

About the company

Encord is the data layer for Physical AI and enterprise, serving as core infrastructure for 300+ of the world's leading AI teams. They are a team of founders, scientists, quants, researchers, and former Olympians.