Location
London

Hours
Full Time

Salary
Negotiable

About the Role
The Financial Times is a globally recognised news organisation known for its authority, integrity and accuracy. We foster a warm, collaborative culture where curiosity thrives and ambitious thinking is rewarded. As a Senior Cyber Security Engineer, you will play a key role in maturing application and cloud security across our cloud-native, AWS-hosted technology estate. This role balances application security and cloud security responsibilities, working closely with product, platform and engineering teams to embed secure delivery practices by default.

You will improve developer-friendly guardrails across GitHub-based CI/CD pipelines, AWS environments and infrastructure-as-code workflows. Your work will include enhancing SAST, software composition analysis, secret scanning, IaC scanning, vulnerability management and AWS misconfiguration management to ensure findings are actionable, low-noise and owned by the right teams.

Day-to-day responsibilities include running practical threat-modelling sessions, reviewing application and cloud designs, improving security playbooks, supporting vulnerability and misconfiguration remediation, and building automation to reduce manual effort. You may also mentor or line-manage one or two security engineers while remaining hands-on with technical work.

Our commitment to diversity, equity and inclusion means we value unique perspectives and strive to create a supportive workplace where all employees can be themselves and operate to their full potential.

Experience
- Strong practical experience in both application security and cloud security, ideally in AWS-hosted, cloud-native environments.
- Hands-on AWS security experience, including common misconfiguration patterns and practical remediation.
- Proven ability to improve vulnerability management across engineering teams, including prioritisation, ownership, remediation tracking and noise reduction.
- Experience managing cloud or infrastructure-as-code misconfigurations at scale with developer-friendly approaches.
- Skilled in integrating, tuning or improving security tooling in CI/CD workflows such as SAST, software composition analysis, secret scanning and IaC scanning.
- Experience facilitating practical threat-modelling sessions that influence design and risk decisions.
- Ability to write scripts or small automation tools, ideally in Python, to reduce toil and improve visibility.
- Strong communication and collaboration skills with the ability to influence engineers and technical leaders.
- Familiarity with Agile or Scrum methodologies.

About You
You are a hands-on security professional who has demonstrably improved security outcomes in real engineering environments. You have a developer-friendly security mindset, able to explain risk clearly and design controls that enable secure, frictionless delivery. You enjoy mentoring others and can influence across teams without gatekeeping. You embrace innovation and continuous improvement.

Qualifications
- While formal certifications are not mandatory, AWS Certified Security – Specialty or equivalent practical AWS security experience is desirable.
- Experience with Terraform or CloudFormation is advantageous.
- Incident management or incident response experience is a plus.
- Familiarity with Splunk or similar logging/SIEM platforms is beneficial.
- Experience with security metrics, dashboards or reporting that drive measurable risk reduction is preferred.
- Experience mentoring or line-managing security engineers is desirable.

Additional Information
Experience leveraging AI to improve and scale application and cloud security controls is useful but not essential.