Advanced Specialist, Security Engineer

J ob Title : Advanced Specialist, Security Engineer

About the Role:

The BU Security Engineering Lead is a security-skilled technology professional who

reports to the BU/function's Designated Risk Owner (DRO), with a dotted-line

alignment to central Security to maintain consistency with enterprise security strategy,

standards and priorities. The role is accountable for improving the BU/function's

security outcomes and achieving agreed security objectives and metrics, working

closely with GRC, Security Architecture and other central Security capabilities.

The role combines security expertise, technical leadership, engineering thinking, data-

driven problem solving and strong business understanding. The Security Engineering

Lead is part of the BU technology organisation, identifying security weaknesses,

understanding their root causes and delivering practical solutions that measurably

reduce security risk.

The role is accountable for improving the BU/function's security outcomes and

achieving agreed security objectives and metrics.

What You'll Do

Own improvement in BU security outcomes

Take accountability for achieving agreed security objectives, targets and metrics

for the BU/function.

Establish a clear understanding of the BU's current security performance, key

exposures and areas of greatest risk.

Use security data, trends and analysis to identify priorities and opportunities for

improvement.

Develop and execute plans to improve security performance and reduce

measurable risk.

DCL2 - Internal Use Only Track progress against agreed objectives and intervene where performance is

not improving.

Identify systemic issues and drive sustainable improvements rather than

repeatedly addressing individual findings.

Drive remediation of security risk

Work directly with technology teams to improve performance against key security

outcomes, including areas such as:

Vulnerability and patch management

End-of-life/end-of-support technology

Privileged access management and reviews

Security control implementation

Security configuration and hardening

Security remediation backlogs

Recurring security findings

Other BU-specific security priorities

The role is expected to understand why a metric is poor and determine what needs to

change to improve it.

This may include process changes, technology changes, automation, data

improvements, changes to ownership or escalation to senior leadership.

Apply engineering thinking to security problems

Use engineering principles to solve security problems at scale.

Identify opportunities to automate repetitive security activities and controls.

Use available security and technology data to identify patterns, root causes and

opportunities for intervention.

Work with engineering and technology teams to design practical solutions.

Challenge approaches that rely primarily on manual activity, repeated chasing or

temporary remediation.

Help establish measurable, sustainable controls rather than one-off compliance

exercises.

Embed security into technology delivery

Act as the BU's security subject matter expert within technology teams.

Participate in relevant technology planning, architecture and delivery activity.

Identify security requirements early in the technology lifecycle.

DCL2 - Internal Use Only Help teams interpret and apply Security policies, standards and control

requirements.

Identify when specialist Security Architecture or other central expertise is

required and bring it into the work at the appropriate point.

Promote secure-by-design engineering practices.

Use data to drive decisions

Establish reliable views of BU security performance.

Analyse security data to identify trends, root causes and priority areas.

Challenge inaccurate, incomplete or misleading security data.

Translate security data into actionable priorities for technology leadership.

Measure whether interventions have actually improved the security outcome.

Provide transparent reporting to the DRO and relevant governance forums.

The role should be evidence-led rather than activity-led: success is demonstrated

through improved security outcomes, not the volume of meetings, communications or

assessments completed.

Risk management and escalation

Provide the DRO with a clear view of current security exposure and material

changes in risk.

Identify risks requiring escalation, remediation investment or formal risk

acceptance.

Support the DRO in understanding the potential business and technology impact

of security risks.

Ensure material security issues are escalated promptly and accurately.

Work with GRC to ensure risks, controls and remediation activity are

appropriately recorded and evidenced.

The Security Engineering Lead does not replace the DRO's accountability for risk; they

provide the expertise, insight and delivery focus required to improve the risk position.

Build security capability within the BU

Develop security awareness and capability within technology teams.

Coach engineers and technology leaders on practical application of security

requirements.

Encourage technology teams to take increasing ownership of security within

their services.

Share successful engineering approaches and lessons learned across the wider

Security community.

DCL2 - Internal Use Only Contribute to a culture in which security is treated as part of good technology

engineering rather than a separate compliance activity.

Key Relationships

BU / Function DRO

The role reports to and works closely with the DRO.

The DRO remains accountable for the BU/function's risk. The Security Engineering Lead

is accountable for achieving agreed security outcomes and providing the DRO with the

expertise, insight and delivery focus required to improve those outcomes.

Technology Leadership and Engineering Teams

The role operates as part of the BU technology organisation and works directly with

engineering, infrastructure, application, identity and other technology teams to deliver

improved security outcomes.

GRC

Works with GRC to:

understand applicable policies, standards and control requirements;

provide evidence of security performance and remediation;

identify and escalate material risks;

support independent governance and assurance; and

maintain consistency of security expectations across the organisation.

GRC provides the independent governance and challenge function; the Security

Engineering Lead is focused on improving the BU's actual security outcomes.

Security Architecture

Works with Security Architecture where specialist expertise, design authority or

complex security decisions are required.

DCL2 - Internal Use OnlyWider Security Function

Participates in the Security community, sharing knowledge, patterns, data and

successful solutions while retaining primary accountability for the BU's agreed

outcomes.

What You Bring

Essential

Significant experience in technology, engineering, cyber security or a closely

related discipline.

Strong understanding of practical cyber security controls and technology risk.

Demonstrable experience working directly with technolo