Senior Cyber Security Engineer

Salary: £62,000 - 88,000 per year

Requirements:

• Strong practical experience in application security and cloud security, ideally with a balanced focus across both.
• Hands-on AWS security experience, including common misconfiguration patterns and practical remediation approaches.
• Experience improving vulnerability management across engineering teams, including prioritisation, ownership, remediation tracking and noise reduction.
• Experience in improving cloud or IaC misconfiguration management at scale in a developer-friendly way.
• Experience integrating, tuning or improving security tooling in CI/CD workflows, such as SAST, software composition analysis, secret scanning or IaC scanning.
• Experience running practical threat-modelling sessions that influence design, delivery or remediation decisions.
• Ability to write scripts or small tools, ideally in Python, to automate security workflows or improve visibility.
• Strong communication and collaboration skills, with the ability to influence engineers and technical leaders without relying on gatekeeping.
• Evidence of improving application security, cloud security or vulnerability management practices in a real engineering environment.
• Familiarity with Agile or Scrum ways of working.
• Experience with leveraging AI for AppSec and CloudSec is desirable.
• AWS Certified Security – Speciality or equivalent practical AWS security experience is desirable.
• Terraform or CloudFormation expertise is desirable.
• Incident-management or incident-response experience is desirable.
• Experience with Splunk or similar logging/SIEM platforms is desirable.
• Experience with security metrics, dashboards or reporting that helped drive measurable risk reduction is desirable.
• Experience mentoring or line-managing security engineers is desirable.

Responsibilities:

• Improve application security guardrails by tuning and evolving SAST, software composition analysis, secret scanning and related controls so they are actionable, low-noise and useful to engineering teams.
• Improve cloud and IaC security guardrails by helping identify, prioritise and reduce AWS and infrastructure-as-code misconfigurations and vulnerabilities at scale.
• Drive vulnerability management by improving how application vulnerabilities, dependency risks, bug bounty findings, penetration test findings and third-party advisories are triaged, prioritised and remediated.
• Drive cloud misconfiguration management by helping teams understand, own and remediate cloud security issues using pragmatic, developer-friendly workflows.
• Run practical threat modelling sessions for new products, features, services and architectural changes.
• Build automation and tooling by creating or improving scripts, integrations, dashboards and workflows that reduce manual effort and make risk easier to understand.
• Support secure architecture decisions by providing application and cloud security input into design reviews, AWS architecture decisions and larger technical changes.
• Partner with engineering teams to embed security into design, delivery and operational practices.
• Support incidents and lessons learned by providing application and cloud security expertise during incidents and feeding lessons learned back into patterns, tooling and guidance.
• Mentor others by coaching security engineers and engineering teams on practical security approaches, and potentially line-managing one or two security engineers depending on team structure.

Technologies:

• AI
• AWS
• CI/CD
• Cloud
• Support
• Python
• Security
• Splunk
• Terraform
• GitHub

More:

We are the Financial Times, one of the worlds leading news organisations, globally recognised for our authority, integrity and accuracy, with a mission to deliver quality information and services worldwide. Our culture is warm and collaborative, and we offer opportunities to grow, learn new skills and build a career with no fixed path. This Senior Cyber Security Engineer role focuses on maturing application and cloud security across our cloud-native, AWS-hosted technology estate, with a balanced 50/50 focus across application security and cloud security. We work closely with product, platform and engineering teams to make secure delivery easier by default. We offer best-in-class benefits that vary by location, including generous annual leave, medical cover, inclusive parental leave packages, subsidised gym memberships and opportunities to give back to the community. We currently operate a hybrid model requiring staff to work onsite 50% of the time, subject to role requirements and regular review. We are committed to diversity, equity and inclusion, and we are a disability confident employer and Valuable 500 signatory.

last updated 36 week of 2026