Overview
Expleo is a trusted partner for end-to-end, integrated engineering, quality services, and management consulting for digital transformation. We help businesses harness unrelenting technological change to deliver innovations that provide a competitive advantage and improve everyday life worldwide.
As part of the Expleo Digital and Emerging Technology (DET) team, you will report to the Head of Cybersecurity and play a key role within our forward-leaning Cybersecurity Practice. In this role, you will support the design and implementation of secure software development processes and cloud-native integration patterns for clients across multiple sectors.
This is a hands-on, delivery-focused role where you will embed DevSecOps principles into engineering pipelines, guide secure software development lifecycle (SSDLC) practices, and advise on adopting security tooling across cloud and hybrid environments. You will work closely with development, DevOps, and platform teams to uplift security maturity, enabling secure and scalable software delivery aligned with industry standards and compliance requirements.
Responsibilities
Embed security practices into software development pipelines by integrating DevSecOps principles, automation tools, and governance controls.
Support the definition, implementation, and continuous improvement of secure software development lifecycle (SSDLC) processes across internal and client delivery teams.
Advise on secure architecture patterns and controls for cloud-native, containerised, and hybrid applications, aligned with industry standards and best practices.
Collaborate with engineering, DevOps, and platform teams to guide the adoption of security tooling across CI/CD environments.
Conduct reviews of application architecture, infrastructure-as-code, and security configurations to identify risks and support remediation planning.
Provide input into security design decisions, threat modelling sessions, and architectural governance forums.
To support engineering teams and deliver clear, practical documentation, including secure development standards, integration guidelines, and process artefacts.
Stay informed on the evolving threat landscape, cloud security trends, and software security vulnerabilities to ensure contemporary and effective delivery.
Qualifications
A degree (or equivalent experience) in Cybersecurity, Computer Science, Software Engineering, or a related technical discipline.
Recognised industry certifications in cybersecurity or application security (CompTIA, ISC2, GIAC, ISACA, or CREST).
Highly desirable are certifications related to secure development and cloud security (CSSLP, AZ-500, SC-100/SC-200, AWS Security, GCSA, GCLD, or similar).
Familiarity with secure coding standards (OWASP, SEI CERT) and SSDLC models (Microsoft SDL, NIST (Apply online only) SSDF).
Knowledge or experience of Product Assurance Schemes (PAS) or product security frameworks (PAS 754, PAS 1296, or similar) is desirable.
DevOps, DevSecOps, or platform certifications (Kubernetes, Terraform, Azure DevOps, GitHub Actions) are advantageous.
Essential skills
Strong understanding of secure software development principles and the software development lifecycle (SDLC/SSDLC).
Proficiency in modern DevOps environments.
Practical experience with cloud security concepts and controls across at least one major cloud platform (AWS, Azure, or GCP).
Solid grasp of secure coding practices and common software vulnerabilities.
Ability to assess code, configurations, and architecture for security issues and provide practical remediation guidance.
Desired skills
Familiarity with infrastructure-as-code (IaC) security practices and tooling.
Knowledge of container orchestration platforms and associated security tooling.
Awareness of compliance and assurance frameworks relevant to secure software.
Understanding cloud-native security services and architectures, including Zero Trust models and shift-left security practices.
Exposure to secure software supply chain practices, including code provenance, dependency management, and SBOM generation.
Experience
Experience in cybersecurity, secure software engineering, or cloud security roles, with a strong emphasis on delivery.
Demonstrable experience embedding security controls and tooling into software development pipelines and DevOps environments.
Hands-on experience implementing or supporting secure development processes (SSDLC), code review practices, or CI/CD security integration.
Proven involvement in cloud-native or hybrid solution development with exposure to major cloud platforms.
Experience collaborating with developers, DevOps, architects, and platform teams to design and implement secure software solutions.
Exposure to application security tooling (SAST, DAST, SCA), cloud security services, and infrastructure-as-code security practices.
Familiarity with agile or DevOps-based delivery models and working across multiple stakeholders or client environments.
What do I need before I apply
You must have the right to work in the UK
