Director, Security

BOLD is looking for a Director of Security to own security across a large portfolio of client-facing products. Our products run on AWS and Azure, ship at high velocity across UI and backend, and make extensive use of AI and LLMs across the customer experience. This is a builder's role, not an audit role. You will design security into our architecture, our delivery pipeline and our AI features, and lead the team that keeps it there. Compliance, certifications and penetration testing are part of the remit, but they are outcomes of a well-run program, not the program itself. We want someone who has already thought hard about what changes when a product talks to a model: prompt injection and hijacking, data leaking through model context, agents with too much authority, and attackers who now use AI too. + What you'll be securing: Layer What we run What we need from you Cloud AWS and Azure, multi-account / multi-subscription One identity, policy and posture model across both clouds Compute Kubernetes (EKS / AKS), containers, CI/CD Supply-chain integrity, runtime detection, least-privilege workloads Edge CDNs, WAF, bot detection agents Tuned defences against scraping, credential stuffing and AI-driven bots APIs Public and partner APIs behind API protection Discovery, schema enforcement, abuse and BOLA/BFLA detection Applications Modern web front ends and backend services Secure-by-default frameworks and paved roads for engineers AI Extensive use of AI and LLMs in client-facing features An LLM threat model, guardrails, evals and monitoring in production ABOUT THIS TEAM BOLD Platform services team design, creates, manage and maintains the highly scalable and distributed services for the wider use of web and mobile product applications/portals/websites. The current list of services is based on Microservices architecture whose domain ranges from visitor tracking, User profiles, authentication, content and payments. Platform team uses state of the art modern technologies like .Net framework, Python, Java, SQL Server, My SQL, Graph DB, SOLR, and a lot of other tools & technologies serving millions of users with hundreds of million transactions everyday through a scalable and fault tolerant architecture. WHAT YOU’LL DO AI and LLM security: Own the threat model for every AI/LLM-powered feature, covering prompt injection and prompt hijacking (direct and indirect), jailbreaks, system-prompt and data leakage, insecure output handling, excessive agency in tool-calling, and model denial-of-wallet. AI assurance: Build adversarial evals and red-team exercises for AI features into the release process, with production monitoring for abuse and drift. Govern internal AI use, including coding assistants, agents with repo or cloud access, plugin integrations and shadow AI. Multicloud security: Set a unified security architecture across AWS and Azure: identity federation and guardrail policies.