Security Software Engineer

The Bbc; Salford; On-site; GBP 70,000 - 90,000; Full time

Job summary

The BBC MediaTech DevOps team seeks a DevSecOps Engineer to help build, operate and secure software delivery across Media Technology. You’ll work on practical engineering problems alongside experienced engineers and teams, spanning cloud, security tooling, CI/CD and automation.

You’ll contribute to secure engineering practices, implement automation, and collaborate on design decisions with senior engineers. The role focuses on versatile exposure across DevSecOps rather than a single platform.

Qualifications

• Experience in software engineering and delivering automation
• Knowledge of cloud infra, preferably AWS, and IaC practices
• Understanding of secure engineering principles and software security best practices
• Ability to troubleshoot across services and implement practical solutions

Responsibilities

• Build integrations connecting security, engineering and data to aid findings
• Develop and improve backend services, tooling and automation
• Work with AWS and Infrastructure as Code to deliver secure cloud services
• Integrate security checks into CI/CD workflows (dependency & code scanning, secrets detection)
• Apply secure engineering practices around IAM, secrets, logging and monitoring
• Operate and improve security and vulnerability management platforms used by teams
• Investigate issues across services and implement fixes
• Write automated tests, documentation and operational tooling
• Deliver well-defined engineering changes from implementation to deployment
• Collaborate with senior engineers on design and estimation
• Understand security problems in collaboration with engineering teams
• Contribute reusable code and automation for other teams
• Use AI-assisted engineering tools to improve coding, testing and security analysis

Skills

Software engineering

Cloud engineering

Security awareness

CI/CD

Automation tooling

Tools

AWS

Terraform

CI/CD tooling

Job description

Join BBC MediaTech DevOps team as a DevSecOps Engineer. You'll help build, operate and improve the software, platforms and automation that support secure software delivery across Media Technology. The role spans software engineering, cloud infrastructure, security tooling, CI/CD, vulnerability management and engineering automation. You'll work on practical engineering problems alongside experienced engineers and engineering teams. The role is intended to give you exposure to different parts of DevSecOps and security engineering rather than specialising in a single platform or security discipline.

Why Join the Team

You’ll work on practical engineering problems alongside experienced engineers and engineering teams. You’ll be expected to independently deliver well-scoped pieces of work, while working with senior engineers on larger or more complex technical changes. The role is intended to give you exposure to different parts of DevSecOps and security engineering rather than specialising in a single platform or security discipline.

Your Key Responsibilities and Impact

• Build integrations that connect security, engineering and organisational data to make findings easier for teams to understand and act on.
• Build, maintain and improve backend services, integrations, automation and internal engineering tools.
• Work with AWS infrastructure and Infrastructure as Code to deliver and operate secure cloud-based services.
• Help integrate security checks and controls into CI/CD workflows, including dependency scanning, code scanning, secrets detection and container or infrastructure security tooling.
• Apply secure engineering practices around identity and access management, secrets, logging, monitoring, data handling and least-privilege access.
• Help operate and improve security and vulnerability-management platforms used by engineering teams.
• Investigate technical issues across services, integrations, cloud infrastructure and security platforms, and implement appropriate fixes.
• Write automated tests, documentation and operational tooling to support reliable production services.
• Deliver well-defined engineering changes independently, from implementation through testing and deployment.
• Work with senior engineers on larger pieces of work, contributing to technical design, estimation and implementation.
• Work with engineering teams to understand security or operational problems and help implement practical solutions.
• Contribute reusable code, patterns, documentation and automation where these can help other teams.
• Use AI-assisted engineering tools where they provide useful support for coding, testing, investigation, automation or security analysis.

• Software Engineering & Delivery - Experience building, maintaining and operating software services, integrations, automation, or engineering tooling, using at least one modern programming language.
• Cloud & Platform Engineering - Experience working with cloud infrastructure (preferably AWS), including Infrastructure as Code, automated software delivery, and CI/CD practices.
• Security & Operational Awareness - Understanding of secure engineering principles, including APIs, authentication, access control, secrets management, monitoring, and software security best practices.
• Problem Solving & Technical Ownership - Ability to investigate technical issues, understand unfamiliar systems, and deliver practical engineering solutions with minimal day-to-day supervision.
• Engineering Collaboration - Experience using source control and automated testing, with the ability to clearly communicate technical challenges, solutions, and implementation decisions within an engineering team, alongside a strong interest in DevSecOps and security engineering.

Desirable

• Application & Cloud Security Tooling - Experience with vulnerability management, application security, cloud security, and related security tooling such as dependency scanning, static analysis, secrets detection, or container scanning.
• Modern Cloud Architectures - Experience working with serverless, container-based, event-driven, or microservice architectures.
• Integration Development - Experience building integrations using APIs, webhooks, and event-driven technologies.
• Operational Excellence - Experience with logging, monitoring, alerting, incident investigation and other operational support practices.
• Platform & Engineering Enablement - Experience contributing to shared engineering platforms or tooling, including the use of AI-assisted development tools to improve engineering productivity.