Security Controls Engineer

Gen is a global company dedicated to powering Digital Freedom through its trusted consumer brands including Norton, Avast, Life Lock, Money Lion and more. Our combined heritage is rooted in financial empowerment and cyber safety for the first digital generations, and today we deliver award‑winning cybersecurity, online privacy, identity protection and financial wellness solutions to nearly 500 million users in more than 150 countries.

Together, we share a collective passion and vision to protect consumers and help them grow, manage and secure their digital and financial lives. We’re always looking for smart, fearless and high‑impact talent who see AI as a teammate – leveraging it to move faster and deliver meaningful results.

When you’re part of Gen, you’ll have the flexibility, tools and support to do your best work and grow your career – from flexible working options and time off to competitive pay, benefits and well‑being programmes. At Gen, we are scrappy and relentlessly customer‑driven. We create room for healthy debate, experimentation and continuous learning, and we seek out people with different experiences, identities and ideas to join our team.

You’ll work with people who back each other, respect each other and understand that our differences are a competitive advantage.

If this sounds like you, we’d love you to be part of Gen.

We’re looking for an independent, driven security professional who thrives at the intersection of security, Dev Ops, and delivery. In this role, you will translate legal and security framework requirements into clear, actionable vulnerability management and remediation programmes that operate across multiple Security and Dev Ops teams. You’ll help design, ope rationalise and continually improve our vulnerability management lifecycle, from identification and triage through prioritisation and remediation to validation and reporting.

This includes secure development practices within regulatory frameworks, coordinated disclosure, SBOM transparency, patch management and post‑deployment monitoring. You will track, report and raise progress, risks and dependencies, partnering closely with a Senior Project Manager and reporting to senior leadership.

• Translate requirements → action:
  Break down legal, regulatory (including Cyber Resiliency Act) and security framework obligations into prioritised, testable tasks for engineering and platform teams. Define concrete technical control requirements across vulnerability detection, remediation SLAs, secure configuration baselines, SBOM management and coordinated disclosure processes.
• Own the vulnerability management lifecycle:
  Drive end‑to‑end vulnerability management across infrastructure, cloud, applications, containers and third‑party components – including scanning, triage, risk‑based prioritisation (CVSS + exploitability + business impact), remediation tracking, validation and closure.
• Integrate security into CI/CD:
  Partner closely with the Application Security team to support SAST, DAST, SCA, container, IaC and cloud configuration scanning into CI/CD pipelines. Ensure findings are automatically ticketed, risk‑ranked and tracked to resolution with measurable SLAs.
• Orchestrate implementation:
  Coordinate work across multiple security domains (e.g. IAM, vuln mgmt, cloud security, appsec) and Dev Ops/Platform teams to drive consistent adoption.
• Plan & track delivery:
  Build delivery plans, track milestones, manage dependencies and maintain a single source of truth (e.g. Jira/Azure Boards).
• Stakeholder management:
  Align with product owners, architects and security SMEs; resolve blockers and facilitate decisions.
• Metrics & reporting:
  Develop actionable dashboards that show vulnerability ageing, SLA compliance, backlog trends, recurring vulnerability patterns, report status, risk exposure and remediation plans to senior leadership in concise dashboards.
• Control mapping & evidence:
  Help map vulnerability management practices to regulatory frameworks and collect/curate evidence for audits.
• Continuous improvement:
  Standardise templates, automate playbooks and evidence collection, and reduce manual triage…