AI Offensive Testing Technical Lead

Within the CISO Offensive Security Tribe, the AI Offensive Testing Technical Lead owns the technical coherence, engineering and industrialisation of Euroclear’s LLM-supported security-testing capability. The role transforms an R&D activity into a secure, reliable and operational service covering AI-assisted SAST, DAST, penetration testing and red-team activities.

Working with Offensive Security specialists, application teams, platform engineers, Enterprise Architecture and Data & AI, the Technical Lead builds the technical setup, infrastructure, integration patterns, operating model and quality controls required for secure, reproducible and evidence-rich testing under strict human oversight.

The capability enhances existing SAST, DAST, penetration-testing and red-team services by leveraging LLM capabilities throughout assessment preparation, execution, analysis and validation. The role ensures that validated findings integrate with prioritisation, remediation, retesting, reporting and secure software-development practices.

Key Accountabilities

• Technical Architecture & Secure Engineering

In collaboration with the Frontier AI Transformation Squad Lead, support the definition and maintenance of the target architecture, technical standards, threat model and engineering roadmap for the LLM-supported testing capability.

Contribute to the build-up of the segregated technical environment (incl. identity, access, network, compute, storage, secrets, logging, egress and model connectivity).

Protect sensitive source code, application data, credentials, testing artefacts and assessment evidence throughout intake, processing, review, retention and deletion.

Ensure the technical setup aligns with enterprise architecture, cloud, data-protection and security requirements and can be operated, supported and scaled reliably.

• Testing Methodology & Model Evaluation

Build repeatable methods for LLM-supported SAST, DAST, penetration testing and red-team activities, including context collection, prompting, orchestration, execution and evidence capture.

Compare frontier models, agents and configurations using consistent measures for coverage, finding quality, repeatability, duration, resource use and cost.

Define an evidence contract covering target, code or asset location, weakness hypothesis, technical proof, affected paths, remediation proposal and validation status.

Version and maintain prompts, model parameters, testing configurations, tools, evaluation datasets and execution workflows to support reproducibility and controlled change.

• Finding Quality & Technical Validation

• Define technical quality gates covering finding accuracy, code or asset reachability, exploitability, attack paths, affected-component deployment and control effectiveness.
• Lead technical review of complex findings and distinguish actionable vulnerabilities from false positives, duplicate findings, non-reachable code and unsupported hypotheses.
• Ensure human validation, authorised scope and explicit approval remain mandatory before intrusive testing or findings enter risk, remediation and reporting workflows.
• Support developers, application owners and security teams with technically credible remediation options, compensating controls and validation evidence.

• Assessment Delivery & Lifecycle Integration

• Plan and oversee technically complex LLM-supported scans and tests, resolve execution issues and ensure outputs are complete, reproducible and reviewable.
• Coordinate SAST, DAST, penetration-testing and red-team use cases with internal specialists and external providers, including scope, prerequisites and rules of engagement.
• Connect validated findings to risk prioritisation, IRM, remediation workflows, retesting, reporting and closure evidence.
• Convert recurring deterministic findings into secure patterns, automated tests, SAST rules, detection content or CI/CD quality gates where appropriate.

• Operationalisation & Technical Leadership

Contribute to architecture documents, technical standards, runbooks and operating procedures, and establish service-quality, performance, capacity and support measures.

Contribute to the transition from R&D to operations by structuring deployment, integration, onboarding, support, knowledge transfer and continuous service improvement.

Your Profile

Qualifications & Experience

• At least 8 years in application security, offensive security, security engineering or software engineering within complex enterprise environments.
• Deep hands-on knowledge of source-code analysis, SAST, DAST, penetration testing, red teaming and secure SDLC practices.
• Strong engineering experience with LLM or agent orchestration, APIs, automation, structured evaluation, observability and operational integration.
• Demonstrated ability to assess code and asset reachability, exploitability, attack paths, control effectiveness and remediation options.
• Experience designing secure cloud execution environments and protecting sensitive source code, credentials and security-assessment data.
• Strong coding or scripting capability and disciplined use of version control, testing, logging, deployment automation and technical documentation.
• Practical experience taking an AI or security R&D capability through industrialisation and into a supportable enterprise service is preferred.

Skills & Competencies

• Application security, offensive security, SAST, DAST, penetration testing, red teaming, secure architecture and vulnerability validation.
• LLM and agent orchestration, APIs, Python or equivalent automation, evaluation methods and observability.
• Azure, containers, CI/CD, infrastructure integration, version control, logging, monitoring and application-security platforms.
• OWASP, CWE, CVE, MITRE ATT&CK or ATLAS, secure coding standards and recognised offensive-testing methodologies.
• Professional English; French or another European language is an advantage.

Behavioural

• Acts as a hands-on technical authority across AI engineering, offensive testing and operational service design.
• Combines innovation with secure, controlled, reproducible and operationally sustainable execution.
• Communicates technical, operational, security and economic trade-offs clearly and drives alignment from R&D through production operation.

About the Team

Part of the CISO Offensive Security Tribe, the LLM-supported testing capability combines secure source-code and asset intake, application context, frontier-model orchestration, SAST, DAST, penetration testing, red-team use cases, human validation, remediation support and retesting. It supports the wider objective of transforming AI-enabled security-testing research into an operational capability that strengthens Euroclear’s ability to discover and