About the role:

We are looking for an engineering manager to lead our application security engineering team. You will be responsible for developing and implementing security strategies, as well as liaising with other teams delivering parts of our overall security posture. You'll be accountable for the security of software you don't write, in teams that don't report to you. The people who do well in this role get there by making the secure path the easiest one.

The ideal candidate will have a proven track record of implementing and improving the maturity of security programs, through the use of automation and systematic approaches in Cloud-based SaaS organizations, and possess excellent leadership and communication skills. You can tell the difference between a finding and a risk, and know how to prioritise risk mitigation, guiding the squad towards the most effective use of their time.

You must have significant engineering acumen as this is a highly technology-driven role. Your main role will be to support your engineering team and to do that you should be able to review a threat model, challenge a severity rating, and contribute to a design review.

Responsibilities:

• Lead our Application Security team covering a range of areas, including application security, cloud security, and internal tooling development. Your team has full ownership in ensuring our code artifacts are secure.
• Lead 1st and 3rd party vulnerability management, including coordinated disclosure with external reporters and embargoed fixes.
• Contribute significantly to technical discussions and direction. You should be a technical coach who can develop your team, drive incidents, and otherwise step in yourself where needed.
• Define, optimize, and implement the engineering strategy in concert with the security leadership team, ICs and stakeholders across the business.
• Regular 1:1s, coaching and mentoring to ensure your team members are motivated, happy and engaged. Providing continuous feedback to ensure that they can add value while maintaining high standards.
• Collaborating with our engineering leaders and other organization stakeholders to help define and influence wider product strategy, roadmaps and designs.
• Be actively engaged with significant incidents, including preparation, simulation, response, and affected customer notification and communications.
• Contributing to and reviewing design documents for upcoming projects. Ensuring projects are well-defined and ready for development. Advise on how to break down projects into tasks.

Requirements:

• Prior experience running a security engineering team.
• You have a strong engineering background and are capable of engaging in technical conversations and challenging teams to arrive at strong technical decisions themselves.
• You will be comfortable working with engineering teams who have a strong sense of autonomy in their decision-making, be it technical or product-focused.
• While you’re great with people and adept at managing relationships, you still keep up-to-date with the latest technical trends and shifts to maintain and enhance your understanding of the challenges your teams face.
• You are experienced in the modern state of AI, AI tooling, and how to both apply it to securing Grafana’s code bases and in the implications it has for our security needs.
• You approach security with a DevOps mindset. You prefer security by enablement, automation, and guardrails over gates and roadblocks.
• You have familiarity with securing and operating on public Cloud (AWS, GCP, Azure) providers, with Kubernetes, and with securing combined open-source software (OSS) and SaaS products.
• You are an excellent written and verbal communicator. You can articulate complex cybersecurity concepts to both technical and non-technical audiences. You are adept at translating security problems to business impact.

Bonus Points:

• A technical background, ideally with programming or software engineering experience, before transitioning into security & leadership.
• Working knowledge of Grafana Labs OSS projects and products. Experience in using observability tooling to solve security problems.
• Experience working with OSS communities.
• Experience securing large-scale distributed systems.

Compensation & Rewards:

In the UK, the Base compensation range for this role is £103,958 - £124,750. Actual compensation may vary based on level, experience, and skillset as assessed throughout the interview process. All of our roles include Restricted Stock Units (RSUs), giving every team member ownership in Grafana Labs' success. We believe in shared outcomes—RSUs help us stay aligned and invested as we scale globally.

#LI-Remote