Principal Software Engineer

ZipRecruiter; Glasgow; Hybrid; GBP 80,000 - 90,000; Full time

Job summary

A leading public service broadcaster is seeking a Principal Software Engineer - Security Engineer for a hybrid role in Glasgow. The successful candidate will work with various teams to implement secure engineering practices and drive secure software development. Candidates should have a strong background in software engineering, security concepts, and experience with cloud platforms like AWS. This position offers competitive salary and comprehensive benefits, prioritizing career development and flexible working.

Benefits

25 days annual leave plus option to buy 5 more

Defined pension scheme

Discounted dental and health care

Flexible 35-hour working week

Qualifications

• Strong track record in software engineering focused on security.
• Experience embedding secure SDLC practices within teams.
• Familiarity with OWASP Top 10 and secure design patterns.

Responsibilities

• Drive secure-by-design implementation across infrastructure and applications.
• Promote secure SDLC practices and collaborate with InfoSec.
• Participate in threat modeling and security validation.

Skills

Application and infrastructure security

Secure development concepts

Agile or DevOps environments

Collaboration and communication

Education

Relevant degree in computer science or related field

Tools

AWS

SAST

DAST

Infrastructure as code

Job description

Job Description

This job is with BBC, an inclusive employer and a member of myGwork – the largest global platform for the + business community. Please do not contact the recruiter directly.

Job Package

Job Title: Principal Software Engineer - Security Engineer

Job Reference:

Band: BAND D

Salary: £80,000-£90,000k depending on relevant skills, knowledge and experience. The expected salary range for this role reflects internal benchmarking and external market insights.

Contract type: Permanent role

Location: This is a hybrid role, and the successful candidate will balance office working with home working

We're happy to discuss flexible working. Please indicate your choice under the flexible working question in the application. There is no obligation to raise this at the application stage but if you wish to do so, you are welcome to. Flexible working will be part of the discussion at offer stage.

Excellent career progression - the BBC offers great opportunities for employees to seek new challenges and work in different areas of the organisation.

Unrivalled training and development opportunities - our in-house Academy hosts a wide range of internal and external courses and certification.

Benefits - We offer a negotiable salary package, a flexible 35-hour working week for work-life balance and 25 days annual leave with the option to buy an extra 5 days, a defined pension scheme and discounted dental, health care and gym. You can find out more about working at the BBC by selecting this link to our candidate pack.

If you need to discuss adjustments or access requirements for the interview process please contact the [e-mail]. For any general queries, please contact: [e-mail].

Job Introduction

The BBC's digital products reach more than 500 million people every week and are trusted globally as a source of news, entertainment and education. That trust is built not only on our editorial standards, but also on the security, reliability and resilience of the systems behind every stream, story and service.

In Engineering Enablement, we're the team that makes secure, high-velocity delivery possible. We build shared cloud platforms, developer tooling and guardrails that let hundreds of product teams ship confidently and sustainably.

We're hiring a Principal Software Engineer - Security Engineer to help us embed secure-by-design thinking across the BBC. You'll work hands-on with engineering teams, applying InfoSec-led policies and architecture in delivery contexts. You'll support threat modelling, promote secure coding practices, and help scale Secure SDLC across the organisation - without reinventing governance or duplicating policy.

It's a high-trust role with real impact: translating strategic security direction into pragmatic, actionable implementation that helps our teams deliver safely at scale.

Interview process

• Stage 1: Technical Deep Dive (60 mins)
  Walk us through your experience delivering secure systems, discuss a real-world scenario, and complete a short security-focused code or design review.
• Stage 2: Collaboration & Influence (60 mins)
  Explore how you collaborate with central security teams, enable secure engineering at scale, and support adoption of policies across delivery teams.

No prep required beyond a few examples of your work.

Main Responsibilities

As a Principal Software Engineer - Security Engineer, you'll work hands-on with product and platform teams across the BBC to embed secure engineering practices that align with InfoSec direction and policies.

• Drive secure-by-design implementation across infrastructure and applications, ensuring delivery aligns with BBC security policy and architectural guidance.
• Promote secure SDLC practices across engineering teams, collaborating with InfoSec on shared tooling, templates and enablement.
• Help teams adopt secure coding standards and integrate automated security checks (SAST, DAST, dependency scanning) into CI/CD pipelines.
• Participate in threat modelling using InfoSec-led methodologies and coordinate validation and review workflows.
• Review technical designs, proposals and code for alignment with security policies, architecture patterns and assurance requirements.
• Act as a bridge between InfoSec and delivery teams - supporting direct collaboration, not acting as a gatekeeper.
• Feed real-world engineering insight back into InfoSec governance and assurance forums.
• Champion secure development and operations practices, coaching teams and scaling adoption through reusable patterns and guidance.
• Partner with infrastructure teams on security operations needs such as hardening, logging and incident readiness.
• Stay ahead of emerging threats and technologies and share relevant insights across the BBC.

Are you the right candidate for the role?

We hire for potential and impact. If most of the statements below describe you, we'd love to hear from you:

• You have a strong track record in software engineering with a focus on application and infrastructure security, ideally in agile or DevOps environments.
• You're fluent in secure development concepts - comfortable with OWASP Top 10, CWE and common secure design patterns.
• You've helped teams adopt secure SDLC practices, working closely with central security or architecture groups.
• You know how to embed tools like SAST, DAST, secrets detection and dependency scanning into CI/CD pipelines, and have the scars to prove it.
• You've worked with complex, multi-tenant cloud platforms - ideally on AWS - and understand shared services, infra-as-code and central governance models.
• You've built secure infrastructure and enforced compliance in the cloud, not just designed it on paper.
• You can translate InfoSec policy into pragmatic implementation without reinventing it - and you're trusted by both engineers and architects.
• You collaborate naturally, earning trust from delivery teams and central stakeholders alike.
• You communicate clearly and credibly - whether explaining risk trade-offs to a squad or feeding technical insight into an assurance board.

It's a bonus if you've also:

• Facilitated or contributed to threat modelling sessions using frameworks like STRIDE or DFDs.
• Reviewed designs and code with a security lens and an eye for policy alignment.
• Navigated delivery in regulated, public service or high-trust environments.
• Been involved in incident response or risk assessment processes.

About the BBC

The BBC is committed to redeploying employees seeking suitable alternative employment within the BBC for different reasons and they will be given priority consideration ahead of other applicants. Priority consideration means for those employees seeking redeployment their application will be considered alongside anyone else at risk of redundancy, prior to any individuals being considered who are not at risk.

We don't focus simply on what we do - we also care how we do it. Our values and the way we behave are important to us. Please make sure you've read about our values and behaviourshere.

matters at the BBC. We have a working environment where we value and respect every individual's unique contribution, enabling all of our employees to thrive and achieve their full potential.

We want to attract the broadest range of talented people to be part of the BBC - whether that's to contribute to our programming or our wide range of non-production roles. The more diverse our workforce, the better able we are to respond to and reflect our audiences in all their .

We are committed to equality of opportunity and welcome applications from individuals, regardless of , , , , , , socio-economic background, and/or belief. We will consider flexible working requests for all roles, unless operational requirements prevent otherwise.

To find out more about and at the BBC, please clickhere.

#LI-DNI