Lead Cloud Security Engineer

JP Morgan; Bournemouth; On-site; GBP 90,000 - 130,000; Full time

Job summary

JPMorgan Chase & Co. is seeking a Lead Cloud Security Engineer to shape secure cloud platforms across AWS, Azure, and GCP, promoting secure-by-design practices within a Bournemouth, United Kingdom setting.

You will champion security controls and drive cross-functional collaboration with engineering, risk, and product teams. You will mentor a matrixed team of security engineers and risk analysts, lead automation initiatives, and partner with senior leaders to ensure security programs align with

Qualifications

• Formal training or certification on security engineering concepts.
• Experience designing enterprise-level cloud security solutions.
• Ability to review AI-assisted security recommendations.

Responsibilities

• Lead risk-based design and assessment of security controls across cloud services.
• Set guardrails and policy as code for infrastructure security.
• Mentor and lead a matrixed team of security engineers and risk analysts.
• Brief senior stakeholders and regulators on control effectiveness.
• Drive tooling and automation strategy for cloud security.

Skills

Security engineering

Cloud security

Leadership

Threat modeling

CI/CD

AI in security

Terraform

Communication

Education

Bachelor's degree in CS/CE/IT

Security certifications

Tools

Terraform

Cloud platforms (AWS/Azure/GCP)

IAM

SOAR

Job description

Join us to make a meaningful impact on the security of our global cloud infrastructure. As a Lead Cloud Security Engineer, you will help shape the future of cybersecurity and technology controls at JPMorgan Chase & Co. You'll collaborate with talented professionals, drive innovation, and advance your career in a dynamic environment. We value your expertise and commitment to continuous improvement. Experience the opportunity to lead, mentor, and influence the direction of cloud security.

As a Lead Cloud Security Engineer in the Cybersecurity & Technology Controls Product Security team aligned to the Azure Cloud programme, you will ensure public cloud adoption is secure and compliant. You will identify and manage risk-related issues, partner with senior leaders, and drive automation of controls. Your role is pivotal in keeping the firm protected, stable, and resilient. You will contribute to a culture of ownership and continuous improvement.

Job Responsibilities:

• Contribute to the evolution of a multi-year information risk and control strategy for public cloud, setting vision, OKRs, and KRIs that align with enterprise risk appetite, policies, and regulatory expectations.
• Use enterprise-authorized AI capabilities within the work environment to accelerate threat modeling, vulnerability analysis synthesis, and security documentation, validating outputs and ensuring sensitive data is handled appropriately.
• Lead risk-based design and assessment of security controls across cloud services, platforms, and reference architectures; establish standardized control baselines and reusable patterns for AWS, Azure, and GCP.
• Chair or co-chair governance forums, make informed risk acceptance decisions, and drive timely remediation, deviation tracking, and benefits realization.
• Partner with senior leaders across engineering, product, and risk to embed security by design, ensuring deep integration with security operations, threat intelligence, IAM, network security, and data protection.
• Set the operating model for infrastructure as code security: define guardrails, policy as code, and automated pre-commit/pre-deploy controls; oversee security reviews for Terraform and platform engineering pipelines.
• Establish and maintain authoritative documentation, standards, and playbooks; implement agile delivery mechanisms for security programs at scale.
• Build, mentor, and lead a high-performing matrixed team of security engineers and risk analysts; develop talent, clarify accountabilities, and cultivate a culture of ownership and continuous improvement.
• Define and report control effectiveness and residual risk through executive-ready dashboards; brief senior stakeholders, audit, and regulators; ensure audit readiness and sustainable evidence practices.
• Drive the tooling and automation strategy for cloud security, including build vs buy evaluations, vendor management, and integration with existing telemetry and SOAR platforms.
• Strengthen cloud incident preparedness and response by leading threat modeling, tabletop exercises, and post-incident reviews that translate lessons learned into control enhancements.
• Apply reuse-first, AI-assisted practices within SDLC/toolchain routines to strengthen security testing and control validation, ensuring traceability/auditability and alignment to resiliency and security expectations.

Required Qualifications, Capabilities, and Skills:

• Formal training or certification on security engineering concepts and advanced applied experience.
• Skilled in planning, designing, and implementing enterprise-level security solutions.
• Demonstrated experience using enterprise-authorized AI capabilities within the work environment to support security engineering workflows with strong validation habits and awareness of data sensitivity.
• Ability to review and validate AI-assisted code/security recommendations before adoption, escalating uncertainty and ensuring outcomes align to security, resiliency, and auditability expectations.
• Advanced in one or more programming languages.
• Proficient across SDLC execution, including agile methodologies such as CI/CD, application resiliency, and security.
• Experience with threat modeling, discovery, vulnerability, and penetration testing.

Preferred Qualifications, Capabilities, and Skills:

• Deep expertise securing public cloud at scale, spanning identity and access management, network segmentation, data protection, logging/monitoring, and native cloud services across AWS, Azure, and/or GCP.
• Proven leadership of cross-functional security programs with measurable outcomes; adept at influencing VP+ stakeholders and navigating complex prioritization across multiple platforms and business lines.
• Exceptional executive communication and stakeholder management skills, including experience engaging internal audit and external regulators with clear narratives, metrics, and remediation roadmaps.
• Demonstrated ability to translate policy and risk requirements into practical designs and policy as code guardrails that balance delivery velocity with control effectiveness.
• Hands-on familiarity with Terraform and infrastructure as code security, DevSecOps and CI/CD concepts, and enforcement frameworks within modern development workflows.
• Strong program execution under tight timelines; highly self-directed with a bias for action, ownership, and outcome orientation.
• Advanced cloud and security certifications are a plus; experience deploying and operating CSPM/CIEM/CWPP solutions is advantageous.