Security Engineer: Threat Detection & Incident Response

CFC; Greater London; On-site; GBP 60,000 - 90,000; Full time

Job summary

CFC is seeking a Security Engineer to join the CISO team in London. You will implement and operate controls across detection and response, identity and access, data protection, product security, and control assurance, collaborating with engineers to strengthen security posture.

You will improve detection rules, conduct incident response, perform threat assessments, and translate security reviews into concrete changes while maintaining clear runbooks and up-to-date documentation.

Qualifications

• Experience in detection and response, identity and access, data protection, product security or control assurance.
• Working knowledge of CI/CD, cloud services and how a change moves from build to production.
• Ability to turn a security review or a threat assessment into a concrete change.
• Judgement to apply data protection and AI controls in proportion to the system and the data.
• Clear writing and speaking, including with engineers and with colleagues outside security.
• Habit of leaving the runbook, the review and the report in a state the next person can use.

Responsibilities

• Improve detection rules, alerts and logs for network and endpoint activity.
• Conduct incident response for complex cases, from investigation through containment and recovery, and file the incident report with the revised playbook.
• Conduct threat assessments, including attack-path reviews and threat hunts, and record the intelligence and new requirements.
• Analyse vulnerability and misconfiguration findings in software, application security tests, the build pipeline, malware defences, email and web protection, secure configuration and network infrastructure, and implement the control for each finding.
• Produce the security design review for projects and write security and privacy checks into the definitions of ready and done.
• Improve conditional access, privileged access, device verification and joiner, mover and leaver processing, and record excessive permissions in the access review.
• Implement data protection controls for new sensitive stores, covering loss prevention, encryption, privacy requests, insider detection and disposal, and record the classification in the data inventory.
• Prepare evidence for control tests and audits, checks it against the asset inventory, and updates the monitoring rules where coverage is missing.
• Build workflow automation and analytics for repeated security tasks, and publish the runbook.
• Coordinate incident exercises and tabletop drills against the continuity plan, and produce awareness training for CFC colleagues.

Skills

Security mindset

Analytical thinking

Problem solving

Clear communication

Tools

CI/CD

Cloud services

Job description

CFC is seeking a Security Engineer to join the CISO team in London. You will implement and operate controls across detection and response, identity and access, data protection, product security, and control assurance, collaborating with engineers to strengthen security posture.

You will improve detection rules, conduct incident response, perform threat assessments, and translate security reviews into concrete changes while maintaining clear runbooks and up-to-date documentation.