Cybersecurity Engineering Service Lead

Job Description:

We're actively seeking a talented Cybersecurity Engineering Service Lead to join the Engineering department within our Operational Risk and Resilience (OR&R) team. In this role, you'll play a key part in identifying, assessing, and communicating cyber, IT, and third‑party risks to support effective enterprise risk management. As the Service Lead, you'll define service strategy and guide execution of the Engineering service's capabilities across the enterprise.

These capabilities include:

* Threat Modelling and Security Reviews - Validate secure design, implementation, and continuous operation across applications, platforms, and services.

* Application Security and Configuration Management Oversight - Partner with 1

LOD stakeholders to create transparency and drive accountability to policies, standards, and controls.

* Security Consulting and Engineering Support - Provide targeted consulting and engineering support to meet OR&R department needs.

The OR&R team operates primarily as a second line of defense (2

LOD), providing independent check and challenge to first‑line technical teams across the enterprise. We provide oversight through validation of controls to help ensure risks are identified early, appropriately assessed, and effectively managed.

This role will be located in our Newport Beach, California office and is classified as hybrid, working four days per week on‑site and one day remote.

How you'll help move us forward:

* Drive a secure‑by‑design approach across the enterprise by embedding Engineering oversight into organizational processes for new projects, purchases, and changes, ensuring security and risk considerations are addressed early and consistently.

* Continuously assess technologies for alignment with defined policies, standards, procedures, and controls, driving remediation, risk acceptance, or escalation where gaps and emerging risks are identified.

* Identify and drive improvement initiatives within the Engineering service that strengthen effectiveness, consistency, and scalability.

* Stay apprised of risk issues across Cyber, IT, and Third‑Party domains, analyzing where earlier Engineering engagement could have improved risk identification, mitigation, or acceptance, and incorporating those learnings into future processes.

* Identify issues and opportunities within the broader OR&R organization where the Engineering service can deliver solutions, including product implementation, automation, or the application of emerging technologies such as generative AI.

* Provide second‑line oversight of first‑line (1

LOD) technical functions, primarily Application Security and Configuration Management, to ensure activities are aligned with established policies, standards, procedures, and controls, and to build confidence in the consistency and quality of execution.

* Define service strategy, establish roadmaps, and create transparency into team performance, risks, and successes through meaningful metrics, reporting, and stakeholder communications.

The experience you bring:

* 8+ years of experience in security engineering, risk management, or a related technical discipline within a large enterprise environment.

* Experience designing, building, and deploying scalable enterprise solutions while balancing risk, velocity, and stakeholder expectations.

* Demonstrated experience assessing the security of products, projects, or technology implementations, including identifying control gaps, design weaknesses, and areas of elevated risk.

* Strong process improvement experience, with the ability to break complex processes into component parts, identify inefficiencies or failure points, and drive continual improvement.

* Experience partnering effectively across technical and non‑technical teams, balancing collaboration with independent challenge to ensure alignment with established policies, standards, procedures, and controls.

What makes you stand out:

* Experience driving or supporting secure‑by‑design initiatives, embedding security and risk considerations into early stages of product development and technology adoption.

* Application Security and/or Configuration Management experience.

*…