UK remote
Senior Security & Compliance Engineer
About this role
Lead the security of cutting-edge construction technology At XYZ Reality, we've created the world's first engineering-grade Augmented Reality solution for construction. Our product, The Atom, is used on major projects worldwide to bring designs to life on-site and help teams build more accurately, efficiently and with fewer mistakes. As a Series B business scaling across the UK, US and Europe, our technology, and the security environment supporting it, is becoming increasingly sophisticated.
Our platform spans cloud-native services, mobile and embedded AR, APIs, real-time collaboration and AI-powered data pipelines.. We're looking for an experienced Senior Security & Compliance Engineer to lead technical security across XYZ Reality and help shape how our security capability scales with the business. The Role This is a senior, high-impact role with genuine ownership and influence across the business. You'll sit within Engineering and work directly alongside the teams building our technology, taking part in architecture discussions, development workflows and technical decisions, rather than reviewing work after the fact.
You'll own security architecture across our technology, embed shift-left practices into how we build, lead cloud and application security, and keep us ahead of both established and emerging threats. As our use of AI develops, you'll help us understand and respond to AI-related risks and attack vectors. Compliance remains an important part of the role. You'll help keep our security certifications current and support GDPR, data residency and enterprise customer requirements.
We're looking for strong hands-on security expertise first, alongside the governance knowledge to work across both. The role is based in London on a hybrid basis, with 3 days per week in the office. What You’ll Be Doing - Own security architecture and technical security across XYZ Reality's technology. - Continuously assess our security posture and drive pragmatic, prioritised improvements. - Lead cloud security across our infrastructure, including container platforms, databases and data pipelines.
- Own core security domains across identity, access, networking and data protection. - Embed security testing and shift-left practices into engineering workflows and CI/CD. - Partner with Engineering and Product on architecture, technical trade-offs and secure-by-design development. - Run threat modelling and support secure coding practices across web, mobile and embedded codebases. - Own vulnerability management, including triage, risk prioritisation, remediation tracking and incident response.