Security Engineer
Overview
DNEG is seeking a security professional to assess applications, cloud services, AI use
cases, and third-party tools before and during their use across the company. The role
combines practical security architecture reviews with hands-on evaluation of security
solutions. The successful candidate will document risks, recommend workable controls,
and support informed approval decisions.
Mandatory Requirements and Expectations
Own defined security reviews independently and escalate material risks or
complex decisions to senior security stakeholders.
Provide clear, evidence-based recommendations that account for security risk,
business use, and implementation effort.
Work closely with engineering, cloud, product, and other internal teams to
understand designs and agree on practical actions.
Maintain accurate review records, decisions, conditions, and follow-up actions for
the security approval process.
Communicate findings constructively to both technical and non-technical
stakeholders.
Duties and Operational Responsibilities
Review application and API designs for authentication, authorization, data
protection, secure integration, and common attack paths.
Perform threat modelling for new systems and significant changes, and
recommend controls that can be implemented and verified.
Assess cloud architectures and configurations, including identity, network
exposure, secrets, encryption, logging, and workload security.
Review proposed AI applications and services for data exposure, access control,
unsafe outputs, prompt injection, and third-party dependencies.
Evaluate third-party tools before company use by reviewing their security
posture, data flows, permissions, integrations, and relevant assurance evidence.
Plan and run proof of concepts for application, cloud, and AI security tools using
agreed evaluation criteria; document effectiveness, integration needs, and
limitations.
Prepare concise risk assessments and recommendations, including proposed
conditions or remediation needed before approval.
Track findings with system and service owners, validate remediation evidence,
and identify unresolved risks for escalation.
Contribute to security standards, review checklists, and reusable design
guidance to improve consistency across assessments.
Mandatory Job Requirements
A successful candidate should demonstrate the following experience and capabilities:
Approximately five years of relevant experience in application security, cloud
security, security engineering, or security architecture.
Experience reviewing application designs and applying secure development
practices, threat modelling, and risk-based remediation.
Working knowledge of application and API security testing, including code,
dependency, and dynamic testing approaches.
Hands-on understanding of security controls in at least one major cloud platform,
particularly identity, networking, data protection, and monitoring.
Ability to evaluate unfamiliar technologies through proof of concepts, define
success criteria, and present a balanced recommendation.
Experience assessing third-party products or services, including how they
access, process, store, and share company or client data.
Working knowledge of security risks in AI-enabled applications and the controls
used to address them.
Strong written communication and the ability to work with engineers and
stakeholders to resolve identified risks.
Desirable Experience
Direct experience assessing generative AI applications, including retrieval-based
systems or applications that use external tools.
Experience with security assurance reports, vendor questionnaires, and
recognized security frameworks such as ISO 27001, NIST, CIS, or OWASP
guidance.
Experience evaluating or operating application security, cloud security, or AI
security tooling.
Education
A bachelor's degree in computer science, information technology, cybersecurity,
or equivalent practical experience is desirable.
Relevant security or cloud certifications are desirable but are not a substitute for
demonstrated practical experience.
