Principal Security Engineer (Risk Specialist)

Role OVO-View

Salary banding: £105,000 - £138,000

Experience: Expert

Working pattern: Full-Time

Reporting to: Director of Information Security

Sponsorship: Unfortunately we are unable to offer sponsorship for this role

This role in 3 words: Pragmatic, Engaging, Builder

Top 3 qualities for this role: Data-driven, Communication, Automator

Where you’ll work:

Depending on the needs of your business area, we expect hub based people to be in the office at least once a week, and to go to OVO Connection events in-person. 

You’ll be assigned to the closest one of our three hub offices, Bristol, Glasgow, or London; unless your role requires field-based work. Each hub has accessible spaces to park your laptop, is designed to inspire people, help them connect and bring big ideas to life.

Everyone belongs at OVO

At OVO, we are on a mission to solve one of humanity's biggest challenges, the climate crisis. And we know it takes all of us to change the world. That's why we need diverse people from all abilities, gender identities, ethnicities, ages, sexual orientations, life experiences and backgrounds to join us.

Teamworking for the planet

Everything we do here spins around Plan Zero. So, naturally, the team you’ll be joining plays a gigantic role in making that happen. Here’s how:

In this individual contributor role, you’ll help shape and deliver the strategic vision for OVO’s Digital Risk engineering programme. This includes developing automated, data-driven risk assessments, risk quantification and introducing accountability measures such as risk exceptions and capacity monitoring. You’ll work both within the immediate team and collaboratively across a wide range of teams throughout OVO.

This role in a nutshell:

As a Principal Security Engineer (Risk Specialist) at OVO, you will be a key technical leader responsible for shaping the risk and security engineering strategies. This involves deep hands-on expertise, strategic thinking, guiding architectural decisions, embedding risk practices in code and at scale, and leading the way in solving complex and emerging risk challenges. You will ensure systems are designed with digital risk embedded from development through to runtime, set the direction for critical risk engineering initiatives, champion risk quantification and engineering excellence, and align the digital risk approach with OVO’s business goals. You will also be recognised as a trusted person in your field within OVO and the wider risk engineering community, particularly in challenging traditional technology risk approaches and building automated, AI-enabled digital risk management systems.

Your key outcomes will be:

• Define Security Strategy & Roadmaps: Lead the definition, refinement, and communication of technical strategies and multi-year roadmaps for key risk engineering capabilities or domains (e.g., zero trust architecture, automated risk discovery and management), aligning them with business objectives, compliance requirements, and the evolving threat landscape.
  
  
• Architectural Leadership & Governance: Develop, maintain, and govern secure reference architectures, critical design patterns, and enforceable technical standards. Provide expert architectural consultation and design reviews for the most complex, critical, or cross-functional projects and platforms. Steer technology choices through an expert security lens.
  
  
• Solve Top-Tier Risk and Resilience Problems: Challenge the traditional security and tech risk assessment and modelling approach. Tackle the most challenging, ambiguous, and impactful technical risk problems facing the organisation, often requiring deep research, novel solution design, and cross-functional collaboration to resolve systemic issues. Prototype, evaluate, and champion innovative security and risk solutions.
  
  
• Lead High-Impact Risk Initiatives: Build an automated and Al-enabled digital risk management system and use risk quantification to shape decision-making and guide us in prioritising risk responses and control design. Drive the technical vision, architecture, and strategy for complex, organisation-wide risk engineering programmes and transformations (e.g., implementing advanced data protection assessments and controls, maturing risk response capabilities, comprehensive attack surface reduction).
  
  
• Organisational Risk Assessment & Strategic Guidance: Serve as a definitive authority