Security Engineer

Overview

DNEG is seeking a security professional to assess applications, cloud services, AI use

cases, and third-party tools before and during their use across the company. The role

combines practical security architecture reviews with hands-on evaluation of security

solutions. The successful candidate will document risks, recommend workable controls,

and support informed approval decisions.

Mandatory Requirements and Expectations

• Own defined security reviews independently and escalate material risks or

complex decisions to senior security stakeholders.

• Provide clear, evidence-based recommendations that account for security risk,

business use, and implementation effort.

• Work closely with engineering, cloud, product, and other internal teams to

understand designs and agree on practical actions.

• Maintain accurate review records, decisions, conditions, and follow-up actions for

the security approval process.

• Communicate findings constructively to both technical and non-technical

stakeholders.

Duties and Operational Responsibilities

• Review application and API designs for authentication, authorization, data

protection, secure integration, and common attack paths.

• Perform threat modelling for new systems and significant changes, and

recommend controls that can be implemented and verified.

• Assess cloud architectures and configurations, including identity, network

exposure, secrets, encryption, logging, and workload security.

• Review proposed AI applications and services for data exposure, access control,

unsafe outputs, prompt injection, and third-party dependencies.

• Evaluate third-party tools before company use by reviewing their security

posture, data flows, permissions, integrations, and relevant assurance evidence.

• Plan and run proof of concepts for application, cloud, and AI security tools using

agreed evaluation criteria; document effectiveness, integration needs, and

limitations.

• Prepare concise risk assessments and recommendations, including proposed

conditions or remediation needed before approval.

• Track findings with system and service owners, validate remediation evidence,

and identify unresolved risks for escalation.

• Contribute to security standards, review checklists, and reusable design

guidance to improve consistency across assessments.

Mandatory Job Requirements

A successful candidate should demonstrate the following experience and capabilities:

• Approximately five years of relevant experience in application security, cloud

security, security engineering, or security architecture.

• Experience reviewing application designs and applying secure development

practices, threat modelling, and risk-based remediation.

• Working knowledge of application and API security testing, including code,

dependency, and dynamic testing approaches.

• Hands-on understanding of security controls in at least one major cloud platform,

particularly identity, networking, data protection, and monitoring.

• Ability to evaluate unfamiliar technologies through proof of concepts, define

success criteria, and present a balanced recommendation.

• Experience assessing third-party products or services, including how they

access, process, store, and share company or client data.

• Working knowledge of security risks in AI-enabled applications and the controls

used to address them.

• Strong written communication and the ability to work with engineers and

stakeholders to resolve identified risks.

Desirable Experience

• Direct experience assessing generative AI applications, including retrieval-based

systems or applications that use external tools.

• Experience with security assurance reports, vendor questionnaires, and

recognized security frameworks such as ISO 27001, NIST, CIS, or OWASP

guidance.

• Experience evaluating or operating application security, cloud security, or AI

security tooling.

Education

• A bachelor's degree in computer science, information technology, cybersecurity,

or equivalent practical experience is desirable.

• Relevant security or cloud certifications are desirable but are not a substitute for

demonstrated practical experience.