Jeavio is a technology services company that specializes in providing innovative solutions to businesses.

We work at the intersection of technology and business, helping organizations leverage cutting-edge tools, including AI, to drive growth and efficiency.

You will build and lead a small, high-impact team; embed security thinking into every phase of the SDLC; and serve as a trusted advisor to engineering leads, engineering managers, and customers as we scale our AI-assisted development practices and deepen our commitments to HIPAA, SOC 2, PCI-DSS, and ISO 27001 compliance.

This is a hands-on management role you will write policies and threat models, run audits, and keep your own technical skills sharp, while also coaching and growing your team.

Key Responsibilities :

Secure Development Practice & Standards :

- Define, document, and enforce a company-wide Secure Software Development Lifecycle (SSDLC) aligned to OWASP, NIST, and similar cloud-native security frameworks.

- Develop and maintain security policies, coding standards, and guardrails tailored to healthcare (HIPAA), financial (PCI-DSS), SOC 2, and ISO 27001 requirements.

- Drive threat modelling, security architecture reviews, and design-level risk assessments for new projects and major feature releases.

- Champion security-by-design across cloud-native (AWS, Azure, GCP) environments including IaC, container security, API security, and secrets management.

AI-Assisted Development Security :

- Establish guidelines and controls for the secure use of AI coding assistants (GitHub Copilot, Claude Code, Cursor etc.) across engineering teams, covering data leakage, IP exposure, and code quality risks.

- Assess and mitigate security risks specific to LLM-integrated products built for customers including (but not limited to) prompt injection, model abuse, and insecure output handling (OWASP LLM Top 10).

- Stay ahead of the rapidly evolving AI security threat landscape and translate findings into actionable team guidance.

Testing, Audits & Assurance :

- Own the application security testing programme : SAST, DAST, SCA, penetration testing, and red team exercises both for internal tooling and customer deliverables.

- Conduct and coordinate security audits and readiness assessments against SOC 2, ISO 27001, PCI-DSS, and HIPAA controls.

- Manage vulnerability disclosure and triage processes; define SLAs for remediation and track them to closure.

- Produce clear, executive-ready security reports for internal leadership and customer stakeholders.

Team Leadership & Culture :

- Hire, mentor, and develop a team of 2 - 5 security engineers and analysts; set clear goals and foster a culture of continuous learning.

- Design and deliver security awareness and secure coding training programmes for the broader engineering organisation.

- Partner with engineering managers and engineering leads to embed security reviews and checkpoints into project delivery workflows.

- Act as the primary point of contact for security-related customer inquiries, audits, and due diligence requests.

Security & Compliance Responsibilities :

As part of our commitment to ISO 27001 certification, the candidate must :

- Secure Data Handling : Ensure secure data handling practices, including robust encryption at rest and in transit, and strictly managed access controls.

- Leakage Prevention : Design and build secure data pipelines specifically engineered to prevent data leakage.

- Policy Adherence : Strictly follow all data privacy, governance, and organizational ISO 27001 policies.

- Risk Management : Continuously monitor, log, and manage potential security risks within all data systems.

- Audit Readiness : Support audit readiness initiatives and uphold rigorous data protection standards.

Required Qualifications :

- 8+ years of experience in application security, software security engineering, or a closely related field, with at least 2 years in a team lead or management capacity.

- Deep hands-on expertise in application security testing tools and techniques : SAST (e.g. Semgrep, Checkmarx), DAST (e.g. OWASP ZAP, Burp Suite), SCA, and penetration testing.

- Proven experience designing and implementing SDLCs and security programmes within a software services or product engineering environment.

- Strong working knowledge of cloud-native security across AWS, Azure, and/or GCP including IAM, network security, container/Kubernetes security, and secure IaC (Terraform, CDK).

- Practical experience with HIPAA, PCI-DSS, SOC 2, and ISO 27001 frameworks not just awareness, but hands-on involvement in audits or certifications.

- Solid grasp of secure coding principles across modern stacks (web, API, mobile) and the ability to conduct meaningful code reviews.

- Excellent written and verbal communication skills; able to translate technical risk into business impact for non-technical audiences.

Preferred Qualifications :

- Relevant certifications such as CISSP, CISM, OSCP, CEH, AWS Security Specialty, or CCSP.

- Experience securing AI/ML pipelines and LLM-powered applications; familiarity with OWASP LLM Top 10 and MITRE ATLAS.

- Background working in a software development services / consulting environment, managing security across multiple simultaneous customer engagements.

- Exposure to DevSecOps toolchains CI/CD pipeline security gates, secrets scanning, container image scanning, and policy-as-code.

- Familiarity with security frameworks beyond compliance: MITRE ATT&CK, NIST CSF, CIS Benchmarks.