Head of Security Engineering (DevSecOps & CISO)

Smarkets

Greater London

Hybrid

GBP 180,000 - 240,000

Full time

14 days+

Application generator

Don’t send a generic resume — generate a resume and cover letter tailored to this exact role.

Get past ATS filters

Benefits offered by this job

Stock options (4-year vesting)

Private health insurance

Pension (up to 6%)

Education budget (£1,000)

Hybrid working

Remote days

In-house chef

Cycle to work

25 days annual leave

Job summary

Smarkets is seeking a Head of Security Engineering to build and lead DevSecOps and CISO programs for our cloud-native trading platforms. You will stand up security from the ground up, partner with Infrastructure, and report to senior leadership and the Board to ensure risk, incident response, and regulatory standards are exceeded.

As the inaugural security hire, you will define strategy across cloud infra, applications, and trading systems, implement CI/CD security, and drive automation with the

Qualifications

Security engineering capabilities in a cloud-native, high-growth environment
Strong communication with executive/regulatory audiences
Familiarity with CFTC system safeguards expectations
Application security principles (OWASP/NIST) and secure SDLC
Proficiency with CI/CD tooling and security tools
Hands-on securing AWS/Azure/GCP, Kubernetes, containers, IaC
Proficiency in Python, Bash, Go or similar

Responsibilities

Inaugural security engineering hire, establish and evolve security capabilities
Own regulatory/industry engagement (including CFTC)
Define risk-based security strategy across cloud infra, apps, trading systems
Lead or support incident response and post-incident analysis
Integrate security into SDLC with SAST/DAST/IA scanning
Implement controls across cloud, containers, IaC; harden access
Establish security monitoring across apps, APIs, infra
Develop security policies meeting DCM/DCO requirements
Maintain evidence for regulatory audits
Partner with engineers to foster security ownership

Skills

Security engineering

DevSecOps

Cloud security

Regulatory familiarity

OWASP / NIST

CI/CD tooling

AWS/Azure/GCP

Kubernetes

Python/Bash/Go

Security automation

Tools

Snyk

Aqua

Trivy

Checkov

Twistlock

Clair

GitHub Actions

GitLab CI

Jenkins

Azure DevOps

CircleCI

Kubernetes

Job description

Head of Security Engineering (DevSecOps & CISO)

ABOUT SMARKETS

Smarkets is a prediction market exchange for sports and political trading, having handled over $50 billion in volume since 2010. We're upending sports betting with the fairest prices, the best technology, and a superior customer experience — powered by attracting great people and building a high-performance environment where they thrive. We're looking for an atypical candidate with strong regulated-business experience to support our growing CFTC business.

THE ROLE

This is our inaugural security hire, working alongside Infrastructure to protect the distributed, real-time systems behind our trading engine. You'll lead our information security programme across our core products and our DCM/DCO entities — a founding build, standing up security engineering from the ground up through go-live and maturing it as we scale. Reporting directly to senior leadership and the Board, you'll own security posture updates and ensure our risk management and incident response frameworks exceed regulatory and operational standards.

ABOUT YOU

Security expert with hands-on experience building security engineering/DevSecOps capabilities in a cloud-native, high-growth environment — ideally financial services or exchange infrastructure
Excellent communication skills for executive, board, and regulatory audiences
Familiarity with CFTC system safeguards expectations, including 17 C.F.R. § 38.1051 and § 39.18 or similar regulatory requirements
Strong grasp of application security principles (OWASP Top 10, NIST) and secure SDLC practices
Proficiency with CI/CD tooling (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI) and security tools (Snyk, Aqua, Trivy, Checkov, Twistlock, Clair)
Hands‑on expertise securing AWS/Azure/GCP, Kubernetes, containers, and IaC
Proficiency in Python, Bash, Go, or similar

RESPONSIBILITIES

First dedicated security engineering hire, working from within Infrastructure and Engineering teams to establish and evolve Smarkets' security capabilities
Own regulatory/industry engagement (including CFTC), reflecting external expectations in internal practice
Define a pragmatic, risk‑based security strategy across cloud infrastructure, applications, trading systems, and corporate environment
Lead or support the investigation, containment and remediation of security incidents, including post-incident root cause analysis and corrective actions.
Work with Engineering teams to build security into the SDLC — SAST, DAST, SCA, container/IaC scanning in CI/CD — without becoming a delivery bottleneck
Implement controls across AWS, Kubernetes, containers, and IaC, hardening identity, secrets, and network access
Establish security monitoring and detection across applications, APIs, and infrastructure
Develop and maintain security policies, standards, and controls meeting DCM/DCO requirements
Maintain evidence and documentation to support regulatory examinations and audits
Act as a security partner to engineers, building a culture of ownership over security

DESIRABLE

Personal interest in sports, exchanges, or trading
Certifications: DSOP, CKS, CISSP, CCSP, CSSLP, or AWS/Azure/GCP Security Specialty
Track record of security automation at scale in Agile/Scrum
Direct experience with regulators/examiners on technology and system safeguards
Familiarity with event contracts, prediction markets, or similar novel futures products under CFTC

OUR VALUES

Push to win · Make others better · Give a shit · Be a pro · Bring the energy

COMPENSATION & BENEFITS