Senior Cyber Security Engineer

About the role

The Financial Times is looking for a Senior Cyber Security Engineer to mature application and cloud security across its cloud-native, AWS-hosted technology estate. The role is roughly split between application security and cloud security, working with product, platform and engineering teams to make secure delivery easier by default. You will shape developer-friendly guardrails across GitHub-based CI/CD pipelines, AWS environments and infrastructure-as-code workflows.

Key responsibilities

• Tune and evolve SAST, software composition analysis, secret scanning and related controls so they are actionable and low-noise for engineering teams.
• Help identify, prioritise and reduce AWS and infrastructure-as-code misconfigurations and vulnerabilities at scale.
• Improve how application vulnerabilities, dependency risks, bug bounty and penetration test findings and advisories are triaged, prioritised and remediated.
• Run practical threat-modelling sessions for new products, features, services and architectural changes.
• Create or improve scripts, integrations, dashboards and workflows that reduce manual effort.
• Give security input to design reviews, AWS architecture decisions and larger technical changes.
• Support secure architecture decisions, partner with engineering teams, support incidents and share lessons learned.
• Mentor security engineers and coaching teams; depending on team structure, this may include line management of one or two engineers.

Required profile

• Practical experience in both application security and cloud security, ideally in AWS-hosted, cloud-native environments.
• Experience improving vulnerability management and cloud/IaC misconfiguration management at scale in a developer-friendly way.
• Experience integrating and tuning security tooling in CI/CD workflows (SAST, SCA, secret scanning, IaC scanning).
• Experience running threat-modelling sessions that influence design, delivery or remediation decisions.
• Ability to write scripts or small tools, ideally in Python, to automate security workflows.
• Familiarity with Agile or Scrum; evidence of improving security practices in a real engineering environment.

Required skills

• AWS security, including common misconfiguration patterns and remediation.
• SAST, software composition analysis, secret scanning and IaC scanning.
• Python scripting.
• Desirable: AWS Certified Security Specialty, Terraform or CloudFormation, Splunk or similar SIEM, incident response, security metrics dashboards, and mentoring experience.