Principal Security Engineer (12 Month FTC)

OVO; Greater London; Hybrid; GBP 105,000 - 150,000; Full time

Job summary

OVO is seeking a Principal Security Engineer (Attack Surface Management) to lead enterprise-level attack surface reduction with hands-on expertise and strong technical leadership. You will shape the identity/access roadmap and implement automated, AI-enabled workflows to strengthen our security posture.

Hub-based with weekly office attendance, reporting to the Deputy CISO, and a 12-month FTC. The role demands expert-level security engineering, cross-functional collaboration, and a proactive

Qualifications

• Expert level in attack surface management.
• Hands-on security engineering experience.
• Experience driving security improvements across enterprise teams.

Responsibilities

• Lead the reduction of the attack surface through automated amplification loops for security exposure management.
• Provide technical leadership for zero trust and identity/access roadmap.
• Drive security improvements and remediation in collaboration with engineering, procurement, risk and security teams.

Skills

Attack surface management

Technical leadership

Security automation

Zero trust

Job description

Role OVO-View

Team: Attack Surface Management

Location: Hub Based - Hybrid for all

Salary banding: £105,000 - £150,000 / 12 month FTC

Experience: Expert

Working pattern: Full-Time

Reporting to: Deputy CISO

Sponsorship: Unfortunately we are unable to offer sponsorship for this role.

This role in 3 words: Pragmatic, Proactive, Engineer

Top 3 qualities for this role: Data-driven, Communication, Automator

Where you’ll work:

Depending on the needs of your business area, we expect hub based people to be in the office at least once a week, and to go to OVO Connection events in-person.

You’ll be assigned to the closest one of our three hub offices, Bristol, Glasgow, or London; unless your role requires field-based work. Each hub has accessible spaces to park your laptop, is designed to inspire people, help them connect and bring big ideas to life.

Everyone belongs at OVO:

At OVO, we are on a mission to solve one of humanity's biggest challenges, the climate crisis. And we know it takes all of us to change the world. That's why we need diverse people from all abilities, gender identities, ethnicities, ages, sexual orientations, life experiences and backgrounds to join us.

Teamworking for the planet:

Everything we do here spins around Plan Zero. So, naturally, the team you’ll be joining plays a gigantic role in making that happen. Here’s how:

In this individual contributor role, you will be on the frontline of OVO's security. You’ll lead the reduction of our attack surface through technical leadership of a consolidated identity and access roadmap and highly automated amplification loops for security exposure management. This work is pivotal to maintaining a proactive and resilient posture, collaborating closely with engineering, procurement, risk and security teams across OVO to build better observability, and deterministic and non-deterministic workflows to better defend our mission to transition to a zero-carbon future.

This role in a nutshell:

As a Principal Security Engineer (Attack Surface Management) at OVO, you will be the key technical leader responsible for shaping the enterprise-wide strategy for zero trust access, attack surface observability and security weakness amplification workflows. This involves deep hands‑on expertise, driving the innovation of exposure management practices, guiding architectural decisions for zero trust access and data loss prevention controls, and leading the way in solving complex, emerging security challenges. You will ensure OVO maintains a proactive and automated defence posture, setting the direction for critical security initiatives, and championing the integration of security standards embedded in configs and code and near miss retros to improve our resilience. You will be recognised as a trusted authority in your field, particularly in building automated, AI‑enabled attack surface reduction workflows, leading critical vulnerability remediation incidents and leading complex control improvement initiatives.

Your key outcomes will be:

• Weakness management:
  • Lead and execute security defect discovery operations, vulnerability management (VM), remediation governance, and recurrence prevention across the enterprise with the aim of continuously improving compliance with policies, procedures, and guidelines.
  • Drive organisational and technical change by defining and implementing changes where required to internal processes & tooling to enhance proactive security controls.
• Identity-focused access security: