Senior Security & Compliance Engineer

Lead the security of cutting-edge construction technology At XYZ Reality, we've created the world's first engineering-grade Augmented Reality solution for construction. Our product, The Atom, is used on major projects worldwide to bring designs to life on-site and help teams build more accurately, efficiently and with fewer mistakes. As a Series B business scaling across the UK, US and Europe, our technology, and the security environment supporting it, is becoming increasingly sophisticated. Our platform spans cloud-native services, mobile and embedded AR, APIs, real-time collaboration and AI-powered data pipelines.. We're looking for an experienced Senior Security & Compliance Engineer to lead technical security across XYZ Reality and help shape how our security capability scales with the business. The Role This is a senior, high-impact role with genuine ownership and influence across the business. You'll sit within Engineering and work directly alongside the teams building our technology, taking part in architecture discussions, development workflows and technical decisions, rather than reviewing work after the fact. You'll own security architecture across our technology, embed shift-left practices into how we build, lead cloud and application security, and keep us ahead of both established and emerging threats. As our use of AI develops, you'll help us understand and respond to AI-related risks and attack vectors. Compliance remains an important part of the role. You'll help keep our security certifications current and support GDPR, data residency and enterprise customer requirements. We're looking for strong hands-on security expertise first, alongside the governance knowledge to work across both. The role is based in London on a hybrid basis, with 3 days per week in the office. What You’ll Be Doing - Own security architecture and technical security across XYZ Reality's technology. - Continuously assess our security posture and drive pragmatic, prioritised improvements. - Lead cloud security across our infrastructure, including container platforms, databases and data pipelines. - Own core security domains across identity, access, networking and data protection. - Embed security testing and shift-left practices into engineering workflows and CI/CD. - Partner with Engineering and Product on architecture, technical trade-offs and secure-by-design development. - Run threat modelling and support secure coding practices across web, mobile and embedded codebases. - Own vulnerability management, including triage, risk prioritisation, remediation tracking and incident response. - Own and evolve security monitoring, detection and response. - Assess emerging threats, including those tied to AI-enabled products and tooling. - Help keep our security certifications current. - Support compliance cycles, including controls testing, evidence gathering and auditor coordination. - Support GDPR and data residency requirements across our infrastructure and data. - Engage with enterprise customers and prospects on our security posture. - Automate security controls and processes wherever possible. - Shape the standards, tooling and operating model for security as the business scales. What We’re Looking For - Demonstrable in-depth hands-on technical security experience across application, cloud and/or infrastructure security. - The confidence to own security decisions end-to-end, not only in an advisory or governance capacity. - Strong cloud security experience with at least one major provider (Azure, AWS or GCP). - Hands-on experience securing cloud-native and containerised environments. - Experience integrating security testing into CI/CD pipelines. - Experience securing infrastructure-as-code