Lead Information Security Engineer

Security Architecture and Cyber Defence InfoSec covers a vast domain of knowledge within the organization. Our mission is to embed security excellence in our business to foster client trust and increase Thoughtworker confidence. Security is an integral part of the change Thoughtworks brings to clients and the industry. We make the right things easy to do. InfoSec work includes security consulting, risk management, cyber security, incident response, and more. InfoSec is a distributed team, spread across the Americas, Europe, India, China, Southeast Asia, and Australia. The Security Architecture and Cyber Defence functions within InfoSec work closely together to improve Thoughtworks' collective security posture. Security Architecture connects incidents, risks, priorities, and initiatives into a whole-of-business security plan of work and partners with other business functions to deliver on those plans; leads our offensive security testing program; and secures our adoption of AI and agentic systems. The Security Engineering function within the Cyber Defence team builds and operates many of the tools, platforms, and controls that put these strategies into practice. Together, these teams are a trusted source of security know-how for Thoughtworkers and a partner to business and technology teams across the organisation. This role will be situated in India. The role is remote first, with some expectation to be able to work from the closest Thoughtworks office on a regular cadence. Calls and collaboration outside standard local business hours are a normal and expected part of the role. Job responsibilities: The Senior Security Consultant is a hands-on, technical role that sits across both the Security Architecture and Security Engineering teams, reporting to the Head of Security Architecture. You will work as a practitioner, reading and contributing to code, operating and extending security tooling, running projects and workstreams, and working directly with engineering and product teams across the business. You will be expected to lead initiatives independently, drive them to completion, and represent the security function credibly with stakeholders at all levels. Technical depth and human skills are equally important in this role. Working across a distributed, multicultural organisation means that trust and clear communication are the mechanism by which the technical work gets done. The ability to build solid working relationships across functions, time zones, and cultures is a core part of what we are looking for. Essential job duties and responsibilities 1. Security architecture and posture improvement Lead and contribute to hands-on security architecture initiatives across multi-functional, multi-disciplinary teams, bringing technical know-how, a strong security mindset, and project leadership skills. Work in ongoing partnership with the internal application security team to harden the organisation's security posture across our estate. Review and threat model system and application designs, identify security gaps, and provide actionable, constructive recommendations that teams can implement without stalling delivery. While AI tooling is in active use in the team, candidates will be expected to demonstrate a baseline capability to recognise, describe, and suggest improvements to common software and system architecture patterns, integration strategies, etc without AI assistance. Contribute to the development and maintenance of security standards, processes, and patterns for the broader organisation. Harden the security architecture of our cloud-based and SaaS-based estates, including identity, network exposure, and configuration. 2. Offensive security and AI agent security Review AI system designs and guardrail implementations, and give security-by-design feedback before deployment. Test AI and LLM-backed applications and agents for security weaknesses, including prompt injection, tool and MCP integration security, excessive agency…