Senior DevSecOps & AI Security Lead

HSBC; Sheffield; On-site; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Private healthcare for all UK-based em

Enhanced maternity and adoption pay

Contributory pension scheme

Job summary

HSBC is seeking a senior cybersecurity leader to combine Cybersecurity Technical Lead and Business Information Security Officer responsibilities within Enterprise Technology. You will partner with the CISO and Deputy CISO to ensure security is built in from inception and risks are managed within appetite and regulatory obligations.

You will drive secure-by-design delivery across SDLC, DevSecOps, and AI lifecycles, with clear reporting that links technical risk to business impact.

Qualifications

• Significant information security experience with depth in AppSec, DevSecOps, platform security, or cyber consulting in regulated environments.
• Hands-on AppSec tooling and practices including SAST, DAST, SCA, secrets management, secure SDLC and threat modelling.
• Knowledge of software supply chain security including SBOM and dependency risk governance.
• Awareness of AI/ML security risks including prompt injection and data integrity risks.

Responsibilities

• Act as cybersecurity SME for the assigned technology organisation, providing technical advisory across programmes, projects, incidents and IT outages.
• Build partnerships across ET CISO, central cyber teams and technology stakeholders such as Architecture and engineering teams.
• Own the divisional application security programme embedding security-by-design across SDLC and DevSecOps including SBOM and secrets management in CI/CD.
• Define and maintain secure coding standards, security acceptance criteria and threat modelling processes for engineering teams.
• Partner with engineering teams to triage and prioritise vulnerabilities with remediation SLAs using CVSS/EPSS-informed prioritisation.
• Oversee penetration testing scope and manage findings through to remediation with CISO-level reporting on security posture.
• Govern security of the internal developer platform and toolchain including source control, build systems, registries and internal API gateways.
• Establish and run the divisional software supply chain security programme aligned to DORA and NCSC guidance.
• Shape the divisional AI security function including AI threat models and governance aligned to EU AI Act and PRA/FCA guidance.
• Own the divisional information security risk register with reporting to senior stakeholders and support regulatory engagement.

Skills

Application security

DevSecOps

Threat modelling

Regulatory compliance

Incident response

Tools

SAST

DAST

SCA

CI/CD tooling

Secrets management

Job description

HSBC is seeking a senior cybersecurity leader to combine Cybersecurity Technical Lead and Business Information Security Officer responsibilities within Enterprise Technology. You will partner with the CISO and Deputy CISO to ensure security is built in from inception and risks are managed within appetite and regulatory obligations.

You will drive secure-by-design delivery across SDLC, DevSecOps, and AI lifecycles, with clear reporting that links technical risk to business impact.