Developer-Friendly AppSec Engineer for Secure CI/CD

Aboutus Ft; United Kingdom; Hybrid; GBP 70,000 - 100,000; Full time

Job summary

The Financial Times is seeking a Cyber Security Engineer to enhance application security across its cloud-native tech estate. The role focuses on secure engineering practices, guardrails for CI/CD pipelines, and close collaboration with product and software engineering teams.

You will drive practical threat modelling, triage vulnerabilities and help teams remediate issues pragmatically, while expanding tooling and secure development practices across the organisation.

Qualifications

• Practical experience identifying, explaining and remediating application security risks.
• Experience working with software engineers to explain and remediate security issues.
• Familiarity with common web application security risks and secure coding practices.
• Experience with vulnerability triage, prioritisation and remediation tracking.
• Experience using or interpreting findings from SAST, software composition analysis, secret scanning or similar.
• Experience participating in or supporting threat-modelling activities.
• Ability to write scripts or small tools, ideally in Python, to automate tasks or improve visibility.
• Familiarity with Agile or Scrum ways of working.

Responsibilities

• Improve application security across the FT’s cloud-native technology estate.
• Build developer-friendly security guardrails for GitHub-based CI/CD pipelines and repositories.
• Support threat modelling, triage vulnerabilities and remediate issues with engineering teams.
• Develop and refine security playbooks and tooling to integrate security into normal delivery.

Skills

Application security

Threat modelling

Vulnerability management

CI/CD security

Python scripting

Cloud security awareness

Security tooling

Communication & collaboration

Agile/Scrum

Tools

SAST

Software composition analysis

Secret scanning

Security playbooks

CI/CD tooling

Job description

The Financial Times is seeking a Cyber Security Engineer to enhance application security across its cloud-native tech estate. The role focuses on secure engineering practices, guardrails for CI/CD pipelines, and close collaboration with product and software engineering teams.

You will drive practical threat modelling, triage vulnerabilities and help teams remediate issues pragmatically, while expanding tooling and secure development practices across the organisation.