Strategy and Leadership 

• Own the SDLC security strategy, policy framework and roadmap, aligned with InfoSec and audit requirements. 
• Lead, mentor and grow a team of DevSecOps engineers, and drive delivery of toolchain hardening programmes. 
• Report on security posture, risk and remediation progress to senior stakeholders. 
• Partner with platform, SRE and engineering leaders to ensure controls are automated, sustainable and widely adopted. 

Security Engineering and Tooling 

• Define and implement baseline security policies and automated guardrails across source control and CI/CD environments. 
• Integrate, manage and tune code quality and application security tools, including SonarQube, Checkmarx and Wiz, within developer workflows. 
• Harden build infrastructure and software supply chain controls, including artifact management with JFrog Artifactory/Xray. 
• Provision, secure and optimise AWS services supporting the developer platform, including EC2, ECS/EKS, Lambda, S3, IAM and CloudFormation/CDK. 
• Lead security architecture reviews and incident response for toolchain security events. 

Governance, Risk and Compliance 

• Govern application security and supply chain tooling, including exception management and remediation service-level agreements (SLAs). 
• Triage security findings, prioritise vulnerabilities by risk and track remediation to closure. 
• Establish governance for credentials, secrets and non-human identities across the developer toolchain. 
• Define governance for AI-assisted development tools and developer endpoint security. 
• Monitor sensitive configuration changes, implement alerting and own audit readiness and compliance evidence.