DevSecOps & Attack Surface Specialist (AI Security)

Royal & Sun Alliance Insurance Ltd; City Of London; Hybrid; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Annual discretionary bonus

Up to 11% pension contributions

Hybrid working

25 days annual leave

Health & wellbeing + virtual GP

Career development and mentoring

Inclusive culture + employee networks

Share investment options

Job summary

Intact Insurance is driving security across software delivery and AI initiatives. We are seeking a DevSecOps and Attack Surface Specialist to embed security across the full SDLC, driving a shift-left approach and partnering with engineering, product, and operations teams.

You will lead application security initiatives, manage Pentest, SAST, SCA and DAST scanning and remediation, and oversee the external attack surface. Hybrid work and strong benefits are offered.

Qualifications

• Strong understanding of application security principles across the full SDLC.
• Hands-on experience with SAST and SCA tooling (Semgrep, Checkmarx, Snyk, OWASP Dependency Check).
• Experience configuring and operating DAST tools (OWASP ZAP, Burp Suite Enterprise, Invicti).
• Ability to triage, validate, and reproduce vulnerabilities through manual testing and PoC development.

Responsibilities

• Embed security across the software development lifecycle and AI systems.
• Lead application security initiatives, managing Pentest, SAST, SCA and DAST scanning and remediation.
• Manage Intact's external application attack surface and monitor domains and exposure.
• Integrate AI-specific security practices across the organisation and cyber defence team.

Skills

Application security

SAST & SCA tooling

DAST tooling

Attack surface management

CI/CD security gates

Tools

OWASP ZAP

Burp Suite Enterprise

Invicti

Semgrep

Checkmarx

Snyk

OWASP Dependency Check

Job description

Intact Insurance is driving security across software delivery and AI initiatives. We are seeking a DevSecOps and Attack Surface Specialist to embed security across the full SDLC, driving a shift-left approach and partnering with engineering, product, and operations teams.

You will lead application security initiatives, manage Pentest, SAST, SCA and DAST scanning and remediation, and oversee the external attack surface. Hybrid work and strong benefits are offered.