Lead DevSecOps Engineer

In AECOM’s AI Engineering team, your work will help protect technology that directly shapes the physical world around us. We build AI-driven products that change how infrastructure and buildings are designed and engineered, reducing waste, cutting CO₂, and making the built environment more efficient and sustainable. This role ensures those products and the platforms behind them are secure by design.

With our AI Engineering team we’ve created a unique setup: a lean, highly technical team with the speed and ownership of a start up, backed by the scale, resources, and domain expertise of one of the world’s leading engineering firms. 

There has never been a better time to be at AECOM. We are leading the industry’s AI transformation, and with our people and technology we deliver excellence and innovate with impact.

We invite you to bring your bold ideas and big dreams to solve the world’s most complex challenges. We're one global team driven by our common purpose to deliver a better world. Join us.

What You’ll Do

As part of our AI Engineering team, you will be the security lead for our products and platform, from first design review through to production. You will review and sign off on new products and features, own the security of our AI and LLM-powered capabilities, drive CVE remediation, maintain the scanning tooling that gives engineers fast feedback, run our penetration testing programme, and lead our response when incidents happen, all while working closely with engineers to reduce risk without slowing delivery.

You will report directly to the CIO and hold the authority to make security sign-off decisions on new products and features. There is also room to grow the security team as our products and platform scale, and you will play a key part in shaping it.

• Run security reviews of new products from design through to launch, using threat modelling to assess architecture, data flows, and third-party dependencies, documenting findings, and agreeing proportionate remediation with product teams
• Own security for our AI and LLM-powered features, threat modelling risks such as prompt injection, sensitive data leakage through prompts and outputs, insecure agent tool use, and abuse of model endpoints, and defining the guardrails and testing approaches to address them
• Secure our AI supply chain, assessing third-party models and model providers, vector stores, and the data used for training and retrieval
• Hold security sign-off authority for new products and features, setting clear, risk-based release criteria so that low-risk changes ship quickly and higher-risk changes receive deeper review
• Own CVE remediation across the platform, triaging vulnerabilities in code, dependencies, container images, and cloud infrastructure by real-world exploitability, and working with engineering teams to patch within agreed timeframes
• Maintain our security scanning tooling, keeping SAST, SCA, secret, container, and Infrastructure as Code scanning in CI/CD up to date and well tuned so that engineers get timely, actionable feedback with minimal noise
• Manage our penetration testing programme, scoping engagements, coordinating with external testers, leading the review of findings, and tracking remediation through to verified closure
• Strengthen cloud and identity security across Azure and GCP, including identity and ac cess management, networking, secrets and key management, logging, and cloud security posture
• Lead the response to security incidents and actively exploited vulnerabilities, coordinating containment, remediation, and post-incident reviews, and keeping incident runbooks up to date
• Establish and run a security champions programme across engineering teams, building shared ownership of security