AI Offensive Testing Technical Lead

Within the CISO Offensive Security Tribe, the AI Offensive Testing Technical Lead owns the technical coherence, engineering and industrialisation of Euroclear’s LLM-supported security-testing capability. The role transforms an R&D activity into a secure, reliable and operational service covering AI-assisted SAST, DAST, penetration testing and red-team activities.

Working with Offensive Security specialists, application teams, platform engineers, Enterprise Architecture and Data & AI, the Technical Lead builds the technical setup, infrastructure, integration patterns, operating model and quality controls required for secure, reproducible and evidence-rich testing under strict human oversight.

The capability enhances existing SAST, DAST, penetration-testing and red-team services by leveraging LLM capabilities throughout assessment preparation, execution, analysis and validation. The role ensures that validated findings integrate with prioritisation, remediation, retesting, reporting and secure software-development practices.

Key Accountabilities

1. Technical Architecture & Secure Engineering

In collaboration with the Frontier AI Transformation Squad Lead, support the definition and maintenance of the target architecture, technical standards, threat model and engineering roadmap for the LLM-supported testing capability.
Contribute to the build-up of the segregated technical environment (incl. identity, access, network, compute, storage, secrets, logging, egress and model connectivity).
Protect sensitive source code, application data, credentials, testing artefacts and assessment evidence throughout intake, processing, review, retention and deletion.
Ensure the technical setup aligns with enterprise architecture, cloud, data-protection and security requirements and can be operated, supported and scaled reliably.

2. Testing Methodology & Model Evaluation

Build repeatable methods for LLM-supported SAST, DAST, penetration testing and red-team activities, including context collection, prompting, orchestration, execution and evidence capture.
Compare frontier models, agents and configurations using consistent measures for coverage, finding quality, repeatability, duration, resource use and cost.
Define an evidence contract covering target, code or asset location, weakness hypothesis, technical proof, affected paths, remediation proposal and validation status.
Version and maintain prompts, model parameters, testing configurations, tools, evaluation datasets and execution workflows to support reproducibility and controlled change.

3. Finding Quality & Technical Validation

Define technical quality gates covering finding accuracy, code or asset reachability, exploitability, attack paths, affected-component deployment and control effectiveness.
Lead technical review of complex findings and distinguish actionable vulnerabilities from false positives, duplicate findings, non-reachable code and unsupported hypotheses.
Ensure human validation, authorised scope and explicit approval remain mandatory before intrusive testing or findings enter risk, remediation and reporting workflows.
Support developers, application owners and security teams with technically credible remediation options, compensating controls and validation evidence.

4. Assessment Delivery & Lifecycle Integration

Plan and oversee technically complex LLM-supported scans and tests, resolve execution issues and ensure outputs are complete, reproducible and reviewable.
Coordinate SAST, DAST, penetration-testing and red-team use cases with internal specialists and external providers, including scope, prerequisites and rules of engagement.
Connect validated findings to risk prioritisation, IRM, remediation workflows, retesting, reporting and closure evidence.
Convert recurring deterministic findings into secure patterns, automated tests, SAST rules, detection content or CI/CD quality gates where appropriate.

5. Operationalisation & Technical Leadership

Contribute to architecture documents, technical standards, runbooks and operating procedures, and establish service-quality, performance, capacity and support measures.
Contribute to the transition from R&D to operations by structuring deployment, integration, onboarding, support, knowledge transfer and continuous service improvement.

Your Profile

Qualifications & Experience

At least 8 years in application security, offensive security, security engineering or software engineering within complex enterprise environments.
Deep hands-on knowledge of source-code analysis, SAST, DAST, penetration testing, red teaming and secure SDLC practices.
Strong engineering experience with LLM or agent orchestration, APIs, automation, structured evaluatio