Lead DevSecOps Engineer in Edinburgh

Working at CreateFuture CreateFuture is an AI-native consulting partner where people do work that matters and are supported to do it well. We work alongside organisations such as PayPal, adidas, NatWest, FanDuel and Money Saving Expert, building digital products and services that make a difference while always putting people first. We’re a team of creators. We write code, shape delivery, build go-to-market strategies, develop AI solutions and create the practices that support our people. We work side by side with our clients, challenging what’s not working and helping them to build the future. Our commitment to craft, quality, and culture has helped us scale to over 600 people in just a few years.CreateFuture is a Great Place to Work-Certified™ company and has won Best Workplaces UK multiple years in a row. Join us on our journey. Let’s create tomorrow, together, today. About the role and team: We are looking for an experienced Lead DevSecOps Engineer to join our growing Security practice. In this role you will drive cloud and application security across client engagements — embedding security thinking into every stage of the SDLC, platform building, mentoring engineers, and helping CreateFuture build world-class DevSecOps capabilities. Our clients span regulated and high-stakes industries including iGaming, healthcare-tech, e-commerce, and financial services. You will work hands‑on with these clients — conducting threat modelling, secure architecture reviews, and penetration testing — while also shaping the internal AI‑powered security tooling that sets CreateFuture apart. What you'll be doing: Cloud Security – Own the cloud security posture for clients, designing and implementing security controls across AWS and Azure using Terraform (including Control Tower, Security Hub, GuardDuty, Azure Entra ID, Defender, and Sentinel) while driving continuous posture improvements (CSPM). Application Security – Own the application security posture for clients, establishing frameworks covering secure development policy and AppSec Maturity Models while performing architecture and code reviews to guide them from current to target state. Security Assessment – Deliver security assessments across client projects, incorporating application and infrastructure penetration testing, automated cloud infrastructure scanning, and in-depth reviews of architecture and source code security to provide actionable remediation guidance. AI‑Powered Security Tooling and Platform – Build and evolve AI‑driven security tooling and platform using Claude Code skills, hosted agents via StrandsAgent, and AWS AgentCore — automating security workflows and increasing coverage at scale. Compliance