Senior DevSecOps & Attack Surface Architect (Hybrid)

Intact Insurance UK; England; Hybrid; GBP 70,000 - 100,000; Full time

Benefits offered by this job

Annual discretionary bonus

Pension up to 11%

Hybrid working

25 days annual leave + bank holidays +

Health & wellbeing + virtual GP

Career development and mentoring

Inclusive culture + employee networks

Share investment options

Job summary

Intact Insurance is transforming its security posture across the software development lifecycle. The DevSecOps and Attack Surface Specialist will lead automated security controls, oversee Pentest/SAST/DAST/SCA activities, and monitor the external attack surface while guiding AI security integration.

You will collaborate with engineering, product, and operations teams to embed security best practices and drive secure development across the organisation.

Qualifications

• Strong understanding of application security across the SDLC.
• Hands-on experience with SAST and SCA tools (Semgrep, Checkmarx, Snyk).
• Experience configuring and operating DAST tools (OWASP ZAP, Burp Suite Enterprise, Invicti).
• Ability to triage, validate, and reproduce vulnerabilities via manual testing/PoC.
• Knowledge of secure coding practices across common languages/frameworks.
• Familiar with CI/CD security gates and automated controls.
• Experience with attack surface management and asset discovery.

Responsibilities

• Champion shift-left security with automated controls.
• Lead app security initiatives: Pentest, SAST, SCA, DAST, remediation.
• Manage external application attack surface and domain monitoring.
• Integrate AI security practices across the org and cyber defence team.

Skills

Application security principles

SAST & SCA tools usage

DAST tooling experience

Vulnerability triage & PoC

Secure coding practices

CI/CD security gates

Attack surface management

Tools

Semgrep

Checkmarx

Snyk

OWASP Dependency Check

OWASP ZAP

Burp Suite Enterprise

Invicti

Job description

Intact Insurance is transforming its security posture across the software development lifecycle. The DevSecOps and Attack Surface Specialist will lead automated security controls, oversee Pentest/SAST/DAST/SCA activities, and monitor the external attack surface while guiding AI security integration.

You will collaborate with engineering, product, and operations teams to embed security best practices and drive secure development across the organisation.