Senior Security & Compliance Engineer

Lead the security of cutting-edge construction technology
At XYZ Reality, we've created the world's first engineering-grade Augmented Reality solution for construction. Our product, The Atom, is used on major projects worldwide to bring designs to life on-site and help teams build more accurately, efficiently and with fewer mistakes.
As a Series B business scaling across the UK, US and Europe, our technology, and the security environment supporting it, is becoming increasingly sophisticated. Our platform spans cloud-native services, mobile and embedded AR, APIs, real-time collaboration and AI-powered data pipelines, and we hold SOC 2 Type II and ISO 27001 certifications.
We're looking for an experienced Senior Security & Compliance Engineer to lead technical security across XYZ Reality and help shape how our security capability scales with the business.
The Role
This is a senior, high-impact role with genuine ownership and influence across the business.
You'll sit within Engineering and work directly alongside the teams building our technology, taking part in architecture discussions, development workflows and technical decisions, rather than reviewing work after the fact.
You'll own security architecture across our technology, embed shift-left practices into how we build, lead cloud and application security, and keep us ahead of both established and emerging threats. As our use of AI develops, you'll help us understand and respond to AI-related risks and attack vectors.
Compliance remains an important part of the role. You'll mature our SOC 2 Type II and ISO 27001 programmes and support GDPR, data residency and enterprise customer requirements. We're looking for strong hands-on security expertise first, alongside the governance knowledge to work across both.
The role is based in London on a hybrid basis, with 3 days per week in the office.
What You’ll Be Doing
- Own security architecture and technical security across XYZ Reality's technology.
- Continuously assess our security posture and drive pragmatic, prioritised improvements.
- Lead cloud security across our infrastructure, including container platforms, databases and data pipelines.
- Own areas including IAM, zero-trust networking, secrets management, access control and encryption.
- Embed shift-left security into engineering workflows, including SAST, DAST, SCA and dependency scanning in CI/CD.
- Partner with Engineering and Product on architecture, technical trade-offs and secure-by-design development.
- Run threat modelling and support secure coding practices across web, mobile and embedded codebases.
- Own vulnerability management, including triage, risk prioritisation, remediation tracking and incident response.
- Own and evolve security monitoring, detection and response.
- Assess emerging threats, including those tied to AI-enabled products and tooling.
- Mature and continuously improve our SOC 2 Type II and ISO 27001 controls.
- Support compliance cycles, including controls testing, evidence gathering and auditor coordination.
- Support GDPR and data residency requirements across our infrastructure and data.
- Engage with enterprise customers and prospects on our security posture.
- Automate security controls and processes wherever possible.
- Shape the standards, tooling and operating model for security as the business scales.
What We’re Looking For
- Demonstrable in-depth hands-on technical security experience across application, cloud and/or infrastructure security.
- The confidence to own security decisions end-to-end, not only in an advisory or governance capacity.
- Strong cloud security experience with at least one major provider (Azure, AWS or GCP).
- Hands-on experience securing containerised and orchestrated environments, including IAM, RBAC, network segmentation, secrets management and image scanning.
- Experience integrating security tooling into CI/CD, including SAST, DAST, SCA and dependency scanning.
- Experience securing infrastructure-as-code and GitOps workflows.
- Understanding of application and API security, including OAuth 2.0, JWT, mTLS and secure development practices.
- Experience identifying vulnerabilities, assessing technical risk and driving remediation.
- Comfortable writing automation in Python, Go, Bash or similar.
- Practical experience with SOC 2 Type II and/or ISO 27001.
- Current knowledge of the threat landscape, particularly AI-related threats.
- Strong communication skills with technical and non-technical stakeholders.
- A pragmatic, collaborative approach: you know great security enables engineering teams.
Experience leading or scaling security within a high-growth or Series A/B technology business would be particularly valuable.
Above all, we're looking for someone technically strong, curious and proactive, who engineers want to work with and who brings credibility to security conversations while staying pragmatic about how we build and ship.
What You Could Be Working On
- Cloud and container security architecture
- Application and API security
- Secure software development and shift-left security
- Vulnerability management and incident response
- AI-related security and emerging threats
- SOC 2 Type II and ISO 27001 maturity
- Security automation and CI/CD integration
- Enterprise customer security requirements
- XYZ Reality's longer-term security roadmap
WHY JOIN US
- 🔐 Lead technical security, with genuine ownership over how it develops at XYZ Reality
- 🏠 Hybrid working from our London office
- 🏝️ 25 days annual leave + public holidays
- 🩺 Private healthcare with Vitality
- 🎄 Additional Christmas shutdown days
- 🪙 Biannual salary reviews
- 🥳 Summer & Christmas company events
- 🍣 Free Thursday lunch and after-work gatherings
- 💰 Employee referral scheme
- 🚲 Cycle to Work scheme
If you're an experienced security engineer who wants to shape and lead security within a growing technology business, we'd love to hear from you.

Employment type
FullTime

Work arrangement
Yes