Hybrid Security Engineering Lead — Product & Offensive Testing

WPP; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Job summary

WPP is seeking a Product, Application and Offensive Security Lead to embed security across DTS products, APIs and data platforms. This hands-on role works with product and engineering teams to review designs, run threat models, test systems and coordinate penetration testing.

You will own security in the software development lifecycle, perform threat modelling, and oversee AI-enabled and agentic security testing while coordinating with ISMS, privacy and risk functions to remediate findings.

Qualifications

• Hands-on security engineering experience within product or security engineering.
• Experience reviewing designs, APIs, and threat modelling.
• Proven ability to coordinate offensive security testing and remediation.
• Knowledge of AI/agentic security is beneficial.

Responsibilities

• Hands-on security support across DTS products and engineering teams.
• Embed secure engineering standards and secure coding practices.
• Run threat modelling and security design reviews for new capabilities.
• Coordinate offensive security testing and vulnerability remediation.
• Provide security assurance for APIs, integrations and data products.
• Coach engineering teams on practical security patterns and risk reduction.
• Collaborate with ISMS/Risk and privacy teams to track material risks.

Skills

Hands-on security engineering

Threat modelling

Secure SDLC

Penetration testing coordination

API security

CI/CD security

Secure design reviews

AI/agentic security knowledge

Stakeholder communication

Tools

SAST

DAST

SCA

CI/CD security tooling

Job description

WPP is seeking a Product, Application and Offensive Security Lead to embed security across DTS products, APIs and data platforms. This hands-on role works with product and engineering teams to review designs, run threat models, test systems and coordinate penetration testing.

You will own security in the software development lifecycle, perform threat modelling, and oversee AI-enabled and agentic security testing while coordinating with ISMS, privacy and risk functions to remediate findings.