QA​/Validation Lead

Own acceptance strategy, cross-stream validation governance, and evidence quality for all 16 delivery streams. This role does not replace domain-specific test execution by workstream engineers Playwright is owned by Frontend, TLS/security tests by the Security Engineer, infrastructure validation by Cloud engineers, and OWASP/unit/integration tests by Java engineers. The QA Validation Lead independently validates completeness, coordinates cross-stream validation, performs targeted independent spot-checks, and confirms agreed acceptance criteria are met before any package is submitted to the client.

Also owns the acceptance tracker, evidence index, gate status, and closure tracking.

• Define formal, measurable acceptance criteria for each delivery stream at the Design Review gate criteria agreed with client stakeholders before execution begins; ambiguous criteria flagged and resolved before sign-off
• Independently validate completeness of all workstream evidence packages produced by stream engineers — spot-check for accuracy, completeness, and consistency before the four-gate submission
• Coordinate cross-stream validation — identify dependencies between streams, ensure evidence from one stream supports acceptance of dependent streams, flag gaps
• Own the acceptance tracker, evidence index, and gate status dashboard — live status per stream, per gate, per environment
• Collect and assemble final closure evidence from all stream engineers — Wiz rescan confirmation from Cloud Engineer Wiz, patch compliance from Cloud Engineer OS/Patching, cipher scan from Security Engineer, OWASP evidence from Java engineers, Playwright results from Frontend, linting reports from Dev Sec Ops
• Coordinate Wiz rescan evidence — confirm specific finding IDs closed per batch using Wiz finding export; package evidence by remediation phase
• Track the 2-business-day four-gate review SLA — elevate any breach to the Program Manager within 4 hours; log in RAID
• Monitor QA capacity activation trigger — if more than 4 delivery streams are simultaneously in Pre-Delivery Testing/evidence closure for >5 business days, or utilisation exceeds 85% for 2 consecutive weeks, flag to Program Manager
• Produce the Phase 6 end-to-end validation report — all 16 streams accepted; report includes evidence index, outstanding risk-accepted findings, and post-engagement review dates

• 7+ years QA engineering; 3+ years on cloud infrastructure or security remediation validation in a regulated industry
• Cross-stream validation governance — ability to coordinate evidence collection across 16 parallel delivery streams without losing threads
• Formal closure evidence packaging — SOC 2, ISO 27001, PCI DSS, or equivalent audit-quality documentation experience
• Acceptance criteria definition — writing measurable, unambiguous criteria that distinguish "done" from "done enough"
• AWS Cloud Watch, VPC Flow Logs, AWS Config — interpretation of compliance reports as validation evidence
• AWS SSM Patch Manager — patch compliance report generation, patch state interpretation (Installed, Missing, Failed)
• OWASP Dependency-Check report interpretation — before/after Critical/High count comparison, PR reference mapping
• TLS/SSL endpoint validation — OpenSSL s_client cipher enumeration, nmap ssl-enum-ciphers, deprecated protocol detection
• Wiz finding export and analysis — CSV/JSON export, finding , rescan result comparison, evidence packaging per finding
• Confluence documentation to executive standard — evidence packages self-contained and structured for CTO and ISSO review

• ISTQB Foundation or Advanced certification
• Qualys vulnerability report interpretation
• ISO 27001 internal audit or SOC 2 readiness assessment…