Director, Cybersecurity Engineering Lead

BlackRock•New York, NY

23h•$215,000 - $275,000•Hybrid

About The Position

The Aladdin Platform Engineering – Engineering Services team builds the platforms, pipelines, and developer tooling that thousands of engineers across BlackRock use every day to design, build, and ship software. Security is engineered into that path rather than inspected at the end of it: the same teams that own build systems, artifact repositories, and deployment pipelines also own the guardrails, evidence, and automated controls that make secure delivery the default. You will lead the cybersecurity engineering function inside this group, working alongside platform engineering, product management, risk, and the firm’s information security organization to protect a large, cloud-native, AI-enabled, highly regulated financial services firm.

Requirements

10+ years in security engineering, platform engineering, or application security, including experience leading teams in a large, regulated enterprise
Deep, hands-on understanding of software supply chain security — build provenance and attestation, artifact signing and verification, dependency risk, and secure software development lifecycle frameworks
Strong command of DevSecOps practice, including CI/CD pipeline security, policy as code, and automated control enforcement at scale
Strong cloud-native security expertise across containers, orchestration, serverless, microservices, and APIs, with fluency in identity, zero trust, and secure architecture patterns
Practical experience securing AI and machine learning workloads or agentic systems, or a demonstrated ability to reason about emerging AI-related risk in software delivery
A track record of influencing engineering organizations without owning them — building adoption of guardrails developers actually want to use — with excellent communication skills across executive, regulatory, and engineering audiences
Bachelor’s degree in a related technical field or equivalent practical experience; industry certifications such as CISSP, CCSP.

Responsibilities

Own the software supply chain security strategy end to end — source integrity, dependency and artifact provenance, software bills of materials, signing, and verifiable build attestation across the firm’s technology estate
Secure the build and release path itself, hardening build systems, artifact repositories, and deployment pipelines as high-value targets, and enforcing trust decisions at admission based on attested provenance rather than implicit trust
Define and implement the security model for agentic and AI-assisted workflows — least-privilege identities for agents, bounded model and data access, provenance for machine-generated code, and guardrails that hold as autonomy increases
Embed automated controls across the delivery lifecycle, including threat modeling, static and dynamic analysis, software composition analysis, and container and infrastructure-as-code scanning, with clear rules for what blocks versus warns
Partner with information security, risk, and audit to translate regulatory and control requirements into engineered, continuously evidenced guardrails, and report progress, coverage, and residual risk to senior technology and business leaders
Build, lead, and mentor a team of security engineers, and grow a network of security champions embedded in delivery teams