Senior DevSecOps Lead – AI & SBOM Security

HSBC Group; Sheffield; On-site; GBP 40,000 - 75,000; Full time

Benefits offered by this job

Private healthcare

Enhanced maternity & adoption pay

Contributory pension

Professional development

Job summary

HSBC Group in the United Kingdom seeks a Senior Vice President to lead divisional information security, owning the application security programme and governance for technology, platforms and AI. You will embed security-by-design across SDLC and DevSecOps, oversee SBOM and dependency risk, and report to CISO-level governance with strong business impact translations.

You will collaborate with ET CISO, central cyber teams, and engineering stakeholders to triage vulnerabilities and mentor teams on

Qualifications

• Significant information security experience with depth in application security, DevSecOps, platform security, and/or technical cyber consulting in a regulated environment.
• Hands-on AppSec tooling and practices, including SAST, DAST, SCA, secrets management, secure SDLC, and threat modelling.
• Working knowledge of software supply chain security, including SBOM and dependency risk governance.
• Solid understanding of AI and ML security risks, including prompt injection, training data integrity risks, model extraction, and agentic AI threats.
• Ability to communicate technical risk clearly to senior stakeholders, translating it into business impact, regulatory exposure, and remediation priorities.
• Strong written and spoken communication in fluent English for technical and non-technical audiences.
• Confidence operating within information security governance, policy, and risk expectations, including risk register management, escalation, and reporting.
• Ability to partner with Cyber Delivery and central cyber functions to align prioritisation, elevate delivery issues, and contribute to path-to-green control improvement initiatives.

Responsibilities

• Act as the cybersecurity SME for the assigned technology organisation, providing technical advisory across programmes, projects, incidents, and IT outages.
• Build strong partnerships across the ET CISO organisation, central cyber teams, and technology stakeholders such as Architecture and engineering teams.
• Own the divisional application security programme, embedding security-by-design across SDLC and DevSecOps, including SAST, DAST, SCA, and secrets management in CI/CD.
• Define and maintain secure coding standards, security acceptance criteria, and threat modelling processes for engineering teams.
• Partner with engineering teams to triage and prioritise vulnerabilities, ensuring remediation SLAs are met using CVSS and EPSS-informed prioritisation.
• Oversee penetration testing scope and manage findings through to remediation with clear CISO-level reporting on security posture.
• Govern the security of the internal developer platform and toolchain, including source control, build systems, package registries, container platforms, secrets management, and internal API gateways.
• Establish and run the divisional software supply chain security programme, including SBOM generation, open-source dependency risk, and third-party component governance aligned to DORA and NCSC guidance.
• Shape the divisional AI security function, including AI threat models and governance aligned to the EU AI Act, our AI risk framework, and relevant PRA and FCA guidance.
• Own the divisional information security risk register, providing tailored reporting to senior stakeholders and supporting regulatory engagement, internal audit, and second-line reviews.

Skills

Information security

Regulated environments

Communication to senior stakeholders

Tools

SAST

DAST

SCA

Secrets management

Secure SDLC

Threat modelling

Job description

HSBC Group in the United Kingdom seeks a Senior Vice President to lead divisional information security, owning the application security programme and governance for technology, platforms and AI. You will embed security-by-design across SDLC and DevSecOps, oversee SBOM and dependency risk, and report to CISO-level governance with strong business impact translations.

You will collaborate with ET CISO, central cyber teams, and engineering stakeholders to triage vulnerabilities and mentor teams on