Location
London, hybrid working model with approximately 50% onsite presence, subject to role requirements and regular review.

Hours
Full Time

Salary
Competitive, details available upon application

About the Role
The Financial Times is seeking a Senior Cyber Security Engineer to mature application and cloud security across its cloud-native, AWS-hosted technology estate. This role balances a 50/50 focus on application security and cloud security, collaborating closely with product, platform and engineering teams to embed secure delivery practices by default. You will enhance developer-friendly guardrails across GitHub-based CI/CD pipelines, AWS environments, and infrastructure-as-code workflows, improving SAST, software composition analysis, secret scanning, IaC scanning, vulnerability management, and AWS misconfiguration management to ensure findings are actionable, low-noise, and owned by the right teams.
Day-to-day responsibilities include running practical threat-modelling sessions, reviewing application and cloud designs, improving security playbooks, supporting vulnerability and misconfiguration remediation, and building automation to reduce toil. You may also mentor or line-manage one or two security engineers while remaining hands-on with technical work.
The Financial Times offers a warm, collaborative culture with a diverse community of experts supporting your growth, career aspirations, and wellbeing. The role provides opportunities to challenge and inspire you, with no fixed career path, allowing you to discover new skills and forge a newsworthy career at the FT.
Our commitment to diversity, equity, and inclusion ensures a supportive workplace where all voices are heard, respected, and valued, with a focus on removing barriers for underrepresented groups.

Experience
- Strong practical experience in both application security and cloud security, ideally in AWS-hosted, cloud-native environments.
- Hands-on AWS security experience, including common misconfiguration patterns and practical remediation.
- Proven ability to improve vulnerability management across engineering teams, including prioritisation, ownership, remediation tracking, and noise reduction.
- Experience improving cloud or infrastructure-as-code misconfiguration management at scale with developer-friendly approaches.
- Skilled in integrating, tuning, or improving security tooling in CI/CD workflows such as SAST, software composition analysis, secret scanning, and IaC scanning.
- Experience running practical threat-modelling sessions that influence design, delivery, or remediation decisions.
- Ability to write scripts or small tools, ideally in Python, to automate security workflows or improve visibility.
- Strong communication and collaboration skills with the ability to influence engineers and technical leaders without gatekeeping.
- Evidence of improving application security, cloud security, or vulnerability management practices in real engineering environments.
- Familiarity with Agile or Scrum methodologies.

About you
- Developer-friendly security mindset with the ability to explain risk clearly and design controls that enable secure, frictionless delivery.
- Collaborative and supportive, able to mentor security engineers and influence wider engineering teams.
- Comfortable working hands-on while providing leadership and guidance.
- Committed to diversity, equity, and inclusion, fostering an environment where all voices are valued.

Qualifications
- Relevant certifications such as AWS Certified Security - Specialty or equivalent practical AWS security experience are desirable but not essential.
- Experience with Terraform or CloudFormation is advantageous.
- Incident management or incident response experience is a plus.
- Familiarity with Splunk or similar logging/SIEM platforms.
- Experience with security metrics, dashboards, or reporting that drive measurable risk reduction.
- Experience mentoring or line-managing security engineers.
- Awareness of leveraging AI to improve and scale application and cloud security controls is beneficial but not required.