Senior DevSecOps Engineer

Artlist; Norwich; On-site; GBP 80,000 - 120,000; Full time

Job summary

Artlist is seeking a Senior DevSecOps Engineer to secure products, AI capabilities and infrastructure. The role spans product security, AI security and cybersecurity systems.

You will work with Product and R&D to embed security from the design stage, build practical safeguards and own security in production. You will lead threat modelling, integrate security into CI/CD, strengthen cloud protections across AWS, GCP and Azure, and own WAF and site protection.

Qualifications

• Four years’ experience in DevSecOps, application security or security engineering with ownership of production systems.
• Track record of embedding security into product design and development.
• Hands-on experience securing cloud environments (AWS/GCP/Azure).
• Practical knowledge of AI/LLM security, including access controls and data leakage protection.

Responsibilities

• Build security into product development: threat modelling and secure design reviews with Product and R&D from design stage.
• Embed security into engineering workflows: CI/CD pipelines, security testing, cloud protection, endpoint detection and testing.
• Define and implement access controls, data exposure safeguards and rate limiting with practical guardrails.
• Secure cloud infrastructure across AWS, GCP and Azure environments.
• Own WAF and site protection: rules, rate limiting, bot protection, DDoS mitigation.
• Lead detection and response: investigate incidents across endpoints, cloud and apps.
• Support security assurance: SOC 2 and ISO 27001 compliance activities.

Skills

Security design

Threat modelling

CI/CD security

Cloud security

WAF configuration

Scripting (Python/Go/Bash)

English communication

Tools

AWS

GCP

Azure

WAF

CI/CD tooling

Job description

Description

Artlist is a leading creative technology company on a mission to empower creators and brands to bring their vision to life with video. Offering cutting-edge AI tools and models for image, video, and voiceover creation, alongside high-quality creative assets and powerful editing tools, Artlist enables creators to stay on trend and achieve their creative goals.

Trusted by over 30 million creators worldwide and top brands including Google, Amazon, Microsoft, and Versace, Artlist provides a seamless, subscription-based platform with a global license, giving creators everything they need to produce professional video content efficiently. For more information, visit artlist.io.

We're looking for a Senior DevSecOps Engineer to help shape how we secure our products, AI capabilities and infrastructure.

This is a broad, hands-on role spanning product security, AI security and cybersecurity systems. You'll work closely with Product and R&D to embed security from the earliest design stages, build practical safeguards and take ownership of security in production.

What you'll do

• Build security into product development: Lead threat modelling and secure design reviews, working directly with Product and R&D from the design stage.
• Embed security into our engineering workflows: Integrate security tooling and controls into CI/CD pipelines, products and infrastructure, including security testing, cloud protection, endpoint detection and penetration testing.
• Establish practical security guardrails: Define and implement controls for access, data exposure, injection attacks and rate limiting, including custom rules.
• Secure our cloud infrastructure: Strengthen security across AWS, GCP and Azure environments.
• Own WAF and site protection: Develop and maintain rules, rate limiting, bot protection and DDoS mitigation.
• Lead detection and response: Investigate and manage security incidents across endpoints, cloud infrastructure and application layers.
• Support security assurance: Contribute to SOC 2 and ISO 27001 compliance activities.

Requirements

What you'll bring

• At least four years' experience in DevSecOps, application security or security engineering, with ownership of production systems.
• A track record of embedding security into product design and development.
• Hands‑on experience securing GCP and/or AWS environments.
• Practical knowledge of AI and LLM security, including model access controls, data leakage prevention and prompt injection.
• Hands‑on experience with WAF configuration and site protection.
• Scripting and automation skills in Python, Go or Bash.
• Fluent English, with the ability to communicate security requirements clearly and work collaboratively across teams.

Nice to have

• Experience securing generative AI or machine learning features in production.
• Familiarity with AI gateways and model access platforms such as LiteLLM, OpenRouter or Amazon Bedrock, alongside LLM observability tools.
• Relevant certifications, such as CISSP or GCP/AWS security certifications.

If you enjoy combining technical depth with the freedom to shape how security gets done, we'd love to hear from you.