Principal Product Security Engineer: Cloud & CI/CD

CFC Underwriting; Greater London; On-site; GBP 110,000 - 150,000; Full time

Job summary

CFC Underwriting in London is seeking a Principal Product Security Engineer to lead strategy and hands-on delivery of security across cloud platforms, code and CI/CD pipelines. This is a senior individual contributor role shaping security patterns and embedding secure-by-default practices across engineering.

You will drive the product-security toolchain, perform threat modelling, and guide engineers on prevention, remediation and recoverability while adopting AI-assisted, safe engineering with

Qualifications

• Deep experience in product, application, cloud and DevOps security.
• Proven experience implementing security tooling in production engineering environments.
• Strong knowledge of CI/CD, cloud-native architecture, IaC and software supply-chain security.
• Practical experience with application testing, dependency analysis, secrets detection, container and cloud posture tooling.
• Ability to write maintainable code, scripts, integrations and policy-as-code.
• Experience leading threat modelling and resolving complex security design trade-offs.
• Ability to assess emerging AI and agentic engineering practices pragmatically and establish proportionate controls.
• Ability to influence senior technical and non-technical stakeholders through evidence and technical credibility.

Responsibilities

• Design and operate the product-security toolchain across source control, CI/CD, cloud, and runtime.
• Integrate code, dependency, secrets, IaC, container, and cloud security testing.
• Build policy-as-code and automation to prevent weaknesses reaching production.
• Secure the software supply chain with trusted dependencies, SBOMs, signing and provenance.
• Lead threat modelling and security design reviews for complex products.
• Diagnose vulnerabilities, reduce false positives, and work with engineers on remediation.
• Create reusable secure cloud, app and pipeline patterns for default adoption.
• Define guardrails for AI-assisted coding and agentic workflows.
• Measure security coverage and remediation velocity across teams.
• Advise stakeholders and coach engineers to raise security and data protection standards.

Skills

Product security

Cloud security

DevOps security

Threat modelling

CI/CD security

Policy-as-code

Scripting/Automation

Stakeholder communication

Job description

CFC Underwriting in London is seeking a Principal Product Security Engineer to lead strategy and hands-on delivery of security across cloud platforms, code and CI/CD pipelines. This is a senior individual contributor role shaping security patterns and embedding secure-by-default practices across engineering.

You will drive the product-security toolchain, perform threat modelling, and guide engineers on prevention, remediation and recoverability while adopting AI-assisted, safe engineering with