Head of Security Engineering (DevSecOps & CISO)

Head of Security Engineering (DevSecOps & CISO)ABOUT SMARKETSSmarkets is a prediction market exchange for sports and political trading, having handled over $50 billion in volume since 2010. We're upending sports betting with the fairest prices, the best technology, and a superior customer experience — powered by attracting great people and building a high-performance environment where they thrive. We're looking for an atypical candidate with strong regulated-business experience to support our growing CFTC business.THE ROLEThis is our inaugural security hire, working alongside Infrastructure to protect the distributed, real-time systems behind our trading engine. You'll lead our information security programme across our core products and our DCM/DCO entities — a founding build, standing up security engineering from the ground up through go-live and maturing it as we scale. Reporting directly to senior leadership and the Board, you'll own security posture updates and ensure our risk management and incident response frameworks exceed regulatory and operational standards.ABOUT YOUSecurity expert with hands-on experience building security engineering/DevSecOps capabilities in a cloud-native, high-growth environment — ideally financial services or exchange infrastructureExcellent communication skills for executive, board, and regulatory audiencesFamiliarity with CFTC system safeguards expectations, including 17 C.F.R. § 38.1051 and § 39.18 or similar regulatory requirementsStrong grasp of application security principles (OWASP Top 10, NIST) and secure SDLC practicesProficiency with CI/CD tooling (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI) and security tools (Snyk, Aqua, Trivy, Checkov, Twistlock, Clair)Hands-on expertise securing AWS/Azure/GCP, Kubernetes, containers, and IaCProficiency in Python, Bash, Go, or similarRESPONSIBILITIESFirst dedicated security engineering hire, working from within Infrastructure and Engineering teams to establish and evolve Smarkets' security capabilitiesOwn regulatory/industry engagement (including CFTC), reflecting external expectations in internal practiceDefine a pragmatic, risk-based security strategy across cloud infrastructure, applications, trading systems, and corporate environmentLead or support the investigation, containment and remediation of security incidents, including post-incident root cause analysis and corrective <actions.Work> with Engineering teams to build security into the SDLC — SAST, DAST, SCA, container/IaC scanning in CI/CD — without becoming a delivery bottleneckImplement controls across AWS, Kubernetes, containers, and IaC, hardening identity, secrets, and network accessEstablish security monitoring and detection across applications, APIs, and infrastructureDevelop and maintain security policies, standards, and controls meeting DCM/DCO requirementsMaintain evidence and documentation to support regulatory examinations and auditsAct as a security partner to engineers, building a culture of ownership over securityDESIRABLEPersonal interest in sports, exchanges, or tradingCertifications: DSOP, CKS, CISSP, CCSP, CSSLP, or AWS/Azure/GCP Security SpecialtyTrack record of security automation at scale in Agile/ScrumDirect experience with regulators/examiners on technology and system safeguardsFamiliarity with event contracts, prediction markets, or similar novel futures products under CFTCOUR VALUESPush to win · Make others better · Give a shit · Be a pro · Bring the energyCOMPENSATION & BENEFITSCompetitive salary + stock options (4-year vesting)Private health insurancePension (up to 6%)£1,000 annual education budget25 days annual leave + bank holidays (5 days carryover)Hybrid working, plus 20 remote days/year globallyIn-house chef, daily snacks and drinksCycle to work schemeSmarkets is an Equal Opportunity Employer, committed to equality, inclusion, and a welcoming environment for all.