Location
Hybrid: London, Bracknell or Bristol (minimum two days per week in office)

Hours
Full Time

Salary
Competitive salary (not specified)

About the Role
Join HealthHero, Europe’s largest digital clinic, at a pivotal moment as we scale our digital healthcare platform across Europe. This is an exciting opportunity to shape security at the heart of a fast-growing, AI-driven business. We are recruiting a Senior Cloud Security Engineer on an initial 12-month fixed term contract, with a view to becoming permanent, based in either our London or Bristol office two days per week.

This role is a fundamental part of a growing Platform Security function covering application security, cloud security, security operations, culture, and risk management. As a tech-centric organisation, the Information Security team plays a critical role in embedding a security-first mindset into application development and continuous monitoring.

You will co-own the cloud security posture and tooling across HealthHero’s AWS and Azure estates, tackling cloud security with an international scope. Supported by Infrastructure, Data Governance, and Engineering leads with security focus, the role emphasizes infrastructure and cloud networking security posture.

Key responsibilities include:
- Championing DevSecOps and SDLC integration of security testing into CI/CD pipelines across development teams using automated security gates such as SAST, DAST, dependency scanning, and secrets detection
- Enabling self-serve security tooling for development teams and setting up development environments
- Managing cloud security posture with tools like Wiz (or similar CSPM)
- Defining and enforcing cloud security baselines, guardrails, and policies in AWS
- Implementing and maintaining IaC security scanning for Terraform
- Managing IAM policies, network segmentation, and secrets management
- Configuring and tuning SIEM (or similar) for cloud-focused detection
- Establishing logging, monitoring, and alerting based on threat modelling
- Investigating and responding to cloud security events
- Identifying, articulating, and escalating security risks with mitigation plans
- Tracking and remediating vulnerabilities across infrastructure
- Managing customer due diligence initiatives
- Supporting annual penetration testing programmes and remediations
- Partnering with internal stakeholders to support governance and accreditation requirements across countries
- Providing expertise on emerging threats and vulnerabilities
- Supporting customer due diligence requests with timely and accurate vulnerability information

Experience
- Proven experience in application security, DevSecOps, or cloud security
- Strong understanding of cloud networking
- Experience securing cloud environments (AWS, Azure)
- Ability to read and write IaC (Terraform) code and familiarity with IaC lifecycles
- Familiarity with container security and Kubernetes
- Understanding of secure coding, penetration testing techniques, SIEM, and vulnerability management
- Strong technical skills in Information Security including secure coding standards, ethical hacking, network security, and risk analysis
- Experience managing Secure Development Lifecycle and Vulnerability Management
- Practical experience with ISO27001:2022 controls and audit processes

About You
- Detail-oriented and proactive with a security-first mindset
- Comfortable working in a fast-paced, high-growth environment
- Collaborative team player with strong stakeholder engagement skills
- Interest in learning health and security regulations across multiple countries (France, UK, Ireland, Germany)

Qualifications
- Desirable: AWS Security Specialty or similar certification
- Experience in regulated environments such as healthcare or financial services
- Familiarity with NHS DSPT
- Technical knowledge of GDPR and data protection requirements
- Hands-on experience with CI/CD security tooling and pipeline integration