Location
London

Hours
Hybrid model requiring onsite presence 50% of the time, subject to role requirements and regular review. Flexible working requests will be considered.

Salary
Not specified

About the Role
The Financial Times (FT) is a globally recognised news organisation known for its authority, integrity and accuracy. At the FT, curiosity thrives and ambitious thinking is rewarded. You will join a warm, collaborative culture connecting with a diverse community of experts who support your growth, career aspirations and wellbeing. This role offers opportunities to challenge and inspire you, with no fixed career path, allowing you to discover new skills and forge a career that can take you anywhere.

We are seeking a Cyber Security Engineer to enhance application security across the FT's cloud-native technology estate. This hands-on role focuses on making secure engineering easier for product, platform and software engineering teams. Application security experience is essential.

You will improve developer-friendly security guardrails across GitHub-based CI/CD pipelines, application repositories and engineering workflows. Responsibilities include working with SAST, software composition analysis, secret scanning, vulnerability management and secure coding guidance to ensure security findings are clear, actionable and owned by the right teams.

You will collaborate closely with engineers to support practical threat modelling, triage application vulnerabilities, improve security playbooks and help teams remediate issues pragmatically. While deep AWS or cloud security expertise is not required, some exposure to AWS, cloud security or infrastructure-as-code security is beneficial.

This role is ideal for someone with practical application security experience who enjoys working with engineers, improving tooling and integrating security into normal delivery processes rather than as a last-minute checkpoint.

Our Commitment to Diversity, Equity and Inclusion
We believe in the power of unique perspectives and want all voices in our organisation to be heard, respected and valued. We are committed to removing barriers for everyone, focusing on underrepresented groups. We foster a supportive workplace where employees can be themselves and operate to their full potential.

Accessibility
We are a disability confident employer and Valuable 500 signatory. Reasonable adjustments can be made during the application process or interview to support candidates.

Experience
- Practical experience in application security.
- Experience working with software engineers to explain and remediate security issues.
- Familiarity with common web application security risks and secure coding practices.
- Experience with vulnerability triage, prioritisation and remediation tracking.
- Experience using or interpreting findings from tools such as SAST, software composition analysis, secret scanning or similar.
- Experience participating in or supporting threat-modelling activities.
- Ability to write scripts or small tools, ideally in Python, to automate tasks or improve visibility.
- Strong communication and collaboration skills.
- Familiarity with Agile or Scrum ways of working.

About You
- Practical application security experience with a developer-friendly security mindset.
- Enjoy working with engineers, explaining risks clearly and helping teams adopt secure practices without unnecessary friction.
- Automation mindset with ability to improve security workflows.
- Growth mindset with willingness to develop skills across application security, cloud security, secure development and modern engineering practices.

Qualifications
- Exposure to AWS security, cloud security or infrastructure-as-code security is desirable.
- Experience with Terraform or CloudFormation.
- Experience with container or Kubernetes security.
- Experience with bug bounty, penetration testing or security testing programmes.
- Experience with Splunk or similar logging/SIEM platforms.
- Exposure to AI security, such as LLM-enabled applications, AI-assisted development workflows or prompt/data leakage risks.
- Experience building dashboards, metrics or reports to support vulnerability management.
- Relevant security certifications or training such as AWS security training, secure coding training, GIAC, ISC2, CREST or equivalent practical experience.