About the role

You will serve as the inaugural security hire, establishing and maturing the security engineering program across cloud infrastructure and trading systems. This role involves defining risk-based security strategies, managing regulatory engagement, and leading incident response efforts while partnering with engineering teams.

What they look for

Security engineering DevSecOps Cloud-native security Regulatory compliance CFTC Application security NIST CI/CD AWS Kubernetes Python Go Risk management Incident response Infrastructure security Secure SDLC

Requirements

The ideal candidate is a security expert with hands-on experience in cloud-native, high-growth environments, preferably within financial services or exchange infrastructure. You must possess strong knowledge of regulatory requirements like CFTC system safeguards and proficiency in security automation, CI/CD tooling, and secure coding practices.

Benefits

Stock options Private health insurance Pension Annual education budget Annual leave Hybrid working Remote days In-house chef Daily snacks and drinks Cycle to work scheme

Full description

Head of Security Engineering (DevSecOps & CISO)

ABOUT SMARKETS

Smarkets is a prediction market exchange for sports and political trading, having handled over $50 billion in volume since 2010. We're upending sports betting with the fairest prices, the best technology, and a superior customer experience — powered by attracting great people and building a high-performance environment where they thrive. We're looking for an atypical candidate with strong regulated-business experience to support our growing CFTC business.

THE ROLE

This is our inaugural security hire, working alongside Infrastructure to protect the distributed, real-time systems behind our trading engine. You'll lead our information security programme across our core products and our DCM/DCO entities — a founding build, standing up security engineering from the ground up through go-live and maturing it as we scale. Reporting directly to senior leadership and the Board, you'll own security posture updates and ensure our risk management and incident response frameworks exceed regulatory and operational standards.

ABOUT YOU

Security expert with hands-on experience building security engineering/DevSecOps capabilities in a cloud-native, high-growth environment — ideally financial services or exchange infrastructure

Excellent communication skills for executive, board, and regulatory audiences

Familiarity with CFTC system safeguards expectations, including 17 C.F.R. § 38.1051 and § 39.18 or similar regulatory requirements

Strong grasp of application security principles (OWASP Top 10, NIST) and secure SDLC practices

Proficiency with CI/CD tooling (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI) and security tools (Snyk, Aqua, Trivy, Checkov, Twistlock, Clair)

Hands-on expertise securing AWS/Azure/GCP, Kubernetes, containers, and IaC

Proficiency in Python, Bash, Go, or similar

RESPONSIBILITIES

First dedicated security engineering hire, working from within Infrastructure and Engineering teams to establish and evolve Smarkets' security capabilities

Own regulatory/industry engagement (including CFTC), reflecting external expectations in internal practice

Define a pragmatic, risk-based security strategy across cloud infrastructure, applications, trading systems, and corporate environment

Lead or support the investigation, containment and remediation of security incidents, including post-incident root cause analysis and corrective actions.

Work with Engineering teams to build security into the SDLC — SAST, DAST, SCA, container/IaC scanning in CI/CD — without becoming a delivery bottleneck

Implement controls across AWS, Kubernetes, containers, and IaC, hardening identity, secrets, and network access

Establish security monitoring and detection across applications, APIs, and infrastructure

Develop and maintain security policies, standards, and controls meeting DCM/DCO requirements

Maintain evidence and documentation to support regulatory examinations and audits

Act as a security partner to engineers, building a culture of ownership over security

DESIRABLE

Personal interest in sports, exchanges, or trading

Certifications: DSOP, CKS, CISSP, CCSP, CSSLP, or AWS/Azure/GCP Security Specialty

Track record of security automation at scale in Agile/Scrum

Direct experience with regulators/examiners on technology and system safeguards

Familiarity with event contracts, prediction markets, or similar novel futures products under CFTC

OUR VALUES

Push to win · Make others better · Give a shit · Be a pro · Bring the energy

COMPENSATION & BENEFITS

Competitive salary + stock options (4-year vesting)

Private health insurance

Pension (up to 6%)

£1,000 annual education budget

25 days annual leave + bank holidays (5 days carryover)

Hybrid working, plus 20 remote days/year globally

In-house chef, daily snacks and drinks

Cycle to work scheme

Smarkets is an Equal Opportunity Employer, committed to equality, inclusion, and a welcoming environment for all.