Principal Product Security Engineer: Cloud & CI/CD Lead

CFC; Royal Borough of Greenwich; On-site; GBP 110,000 - 150,000; Full time

Job summary

CFC is seeking a Principal Product Security Engineer in London to lead the strategy and hands-on delivery of security across cloud platforms, code and CI/CD pipelines. You will act as a senior technical authority, shaping secure-by-default patterns and embedding security across engineering teams.

You will guide threat modelling, vulnerability remediation and build reusable security patterns for scalable deployment, including guardrails for AI-assisted coding and agentic workflows.

Qualifications

• Deep experience in product, application, cloud and DevOps security.
• Proven experience implementing security tooling in production environments.
• Strong knowledge of CI/CD, cloud-native architecture, IaC and software supply-chain security.
• Practical experience with testing, dependency analysis, secrets detection, container and cloud posture tooling.
• Ability to write maintainable code and policy-as-code.
• Experience leading threat modelling and security design reviews.

Responsibilities

• Design and operate the product-security toolchain across CI/CD, cloud and runtimes
• Integrate and tune code, dependencies, secrets and IaC security testing
• Build policy-as-code and pipeline controls to prevent weaknesses
• Secure the software supply chain with SBOMs, artefact signing, provenance
• Lead threat modelling and security design reviews for complex products
• Diagnose vulnerabilities, reduce false positives, work with engineers on remediation
• Create reusable secure cloud and pipeline patterns for default adoption
• Define guardrails for AI-assisted coding and agentic workflows

Skills

Product security

Cloud security

DevOps security

CI/CD security

Infrastructure as Code

Threat modelling

Secure coding

Tools

SBOM tooling

Policy-as-code

Container security tooling

Cloud posture tooling

Job description

CFC is seeking a Principal Product Security Engineer in London to lead the strategy and hands-on delivery of security across cloud platforms, code and CI/CD pipelines. You will act as a senior technical authority, shaping secure-by-default patterns and embedding security across engineering teams.

You will guide threat modelling, vulnerability remediation and build reusable security patterns for scalable deployment, including guardrails for AI-assisted coding and agentic workflows.