Lead Agentic Security Engineer

About the role

IFS is hiring a Lead Agentic Security Engineer in Colombo. This is a technical leadership role, not a people-management role, where you set technical direction for security engineering, own critical security capabilities, drive cross-team security initiatives and mentor engineers at all levels. You balance risk, delivery and engineering realities.

Key responsibilities

• Define technical direction for security engineering and own AppSec, CloudSec, CI/CD security and vulnerability management end to end
• Set standards, patterns and guardrails that scale across teams, and lead security initiatives across engineering teams
• Drive security automation and tooling strategy (SAST, SCA, DAST, IaC, container security), including AI-assisted and AI-augmented tooling for triage, correlation and remediation guidance
• Evaluate and apply AI tools such as AI-assisted code review, AI-powered vulnerability triage and LLM-based threat and log analysis, validating their output
• Build the team's fluency with AI-assisted engineering tools and set guardrails against risks such as prompt injection and data leakage
• Lead response and root-cause analysis for significant security incidents and coordinate external engagements such as penetration testing vendors
• Own security engineering input into compliance efforts (ISO 27001, SOC 2, FedRAMP) and mentor engineers and emerging leads

Required profile

• Typically 5+ years in security engineering, software engineering or platform engineering
• Proven track record owning security capabilities or programs at scale
• Demonstrated technical leadership and cross-team influence
• Working knowledge of DevSecOps principles and practices
• Strong communication and collaboration skills

Required skills

• Hands-on experience with CI/CD tools such as Bitbucket, Jenkins, GitLab or GitHub Actions
• Proficiency in security platforms, vulnerability management tools and at least one scripting language (e.g. Python, Bash)
• Familiarity with containerization tools (Docker, Kubernetes) and security standards (NIST, ISO 27001, CIS)
• Solid understanding of common vulnerabilities (OWASP Top 10) and remediation approaches