Senior/Lead Cloud Security Engineer

Flo; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

ESOP

Parental leave

Learning budget

Flexible work

Job summary

Flo is seeking a Cloud Security Engineer to join Velocity, our Internal Platform team. You will embed security into the core stack and automate security across CI/CD, infrastructure, and container lifecycles to enable fast, trusted shipping.

We value 7+ years in security roles, deep AWS knowledge, Kubernetes security, and experience with security monitoring and policy-as-code. This hybrid role offers flexible work with London office presence and an ESOP program.

Qualifications

• 7+ years in Infrastructure Security, Cloud Security, or Security Engineering roles.
• Proven experience securing AWS environments and cloud-native tools.
• Strong knowledge of security monitoring, incident response and IAM concepts.
• Experience with IaC and security automation across pipelines.

Responsibilities

• Embed security into the platform and core stack, making security invisible to developers.
• Automate security across CI/CD pipelines, infrastructure, and container lifecycles.
• Own and strengthen Flo’s AWS security posture using GuardDuty, Inspector, Security Hub, and SSM Patch Manager.
• Harden container image security end-to-end and enforce policies at admission with Kyverno/Checkov.
• Practice policy as code to ensure standards are enforced programmatically.
• Build security observability and metrics with Databricks or Looker.
• Support privacy features and security culture across teams.

Skills

Cloud security

Security as code

Zero Trust

Security monitoring

AWS security

Kubernetes security

Infra security

SIEM

Tools

Terraform

Terragrunt

Cosign

Sigstore

Kyverno

Checkov

GuardDuty

Inspector

Security Hub

SSM Patch Manager

Job description

• We are looking for a Cloud Security Engineer to join Velocity, our Internal Platform team. Your mission is to ensure that every system, pipeline, and tool our engineers rely on is secure by default - so they can ship fast without ever compromising trust


• The Velocity team exists to eliminate friction. We build and own the foundation everything else runs on: cloud infrastructure, developer tooling, and SRE practices. You will:


• Embed Security Into the Platform: Bake security, compliance, and best practices into the core stack so they’re invisible to developers and impossible to skip


• Automate Everything: Drive security-as-code across infrastructure, CI/CD pipelines, and container lifecycles - making manual gates a thing of the past


• Cloud Security Posture: Own and continuously strengthen Flo’s AWS security posture using tools like GuardDuty, Inspector, Security Hub, and SSM Patch Manager


• Container & Supply Chain Security: Harden container image security end-to-end - patch vulnerabilities automatically with Copacetic, sign and verify images with Cosign/Sigstore, and enforce policies at admission with Kyverno


• Policy as Code: Manage CI/CD security across the organisation using policy-as-code tooling (Kyverno, Checkov), ensuring standards are enforced programmatically


• Security Observability: Build visibility into security performance by measuring and visualising actionable metrics using tools like Databricks Dashboards or Looker


• High-Scale Privacy: Support the infrastructure for industry-leading privacy features, such as our TIME-recognised Anonymous Mode.


• Culture & Thought Leadership: Shape Flo’s broader security culture through proactive engagement, documentation, and cross-team collaboration

Benefits

• Participation in Flo’s success: We firmly believe every employee contributes to the company’s growth and its future success. All employees are eligible to participate in Flo’s Employee Share Ownership Plan (ESOP) and be awarded equity to participate in the long-term value creation of the business


• Family benefits: We know having a baby can be a big transition for the family, so we’re proud to offer 1 month fully paid paternity leave to be there and bond with your baby and 6 months of fully paid maternity leave, with a $5000 bonus on your return to work to help you settle into this new chapter of your life. (Depending on your country there may be additional options for parental time off and shared parental leave beyond the early days)


• Resources you need to thrive: At Flo you will have access to internal and external learning resources and tools to challenge your knowledge and push yourself further every day. We support career progression from within through personal development plans and dedicated Learning & Development budget to help you thrive


• Holiday and sick leave: It’s important to take time off to recharge and spend time with family and friends. We offer 25 days (28 for vice presidents and above) paid holiday in addition to the local public holidays and 30 days fully paid sick leave per year


• Flexible workplace: We want to provide a setup that gives our employees the flexibility they need, while also getting important face to face time with the team. With this in mind, we encourage teams to spend 2 days/week in the office.

Our popular Workation policy also allows you to work from anywhere for up to 2 months a year

Automation Mindset: Comfortable scripting in Python, Bash, or similar to automate security workflowsCloud Native Mastery: Deep expertise in AWS security services and best practices is essentialContainer Security: Strong knowledge of Kubernetes security, image hardening, and admission controlInfrastructure as Code: Proficient in Terraform and Terragrunt - you run everything as codeExperience: 7+ years in Infrastructure Security, Cloud Security, or Security Engineering rolesSSDLC: Experience building Secure Software Development Lifecycle phases into engineering workflowsNetwork Security: Understanding of modern network security principles and their practical applicationIdentity & Access: Solid understanding of identity management principles - SSO, OAuth, JWT, SAMLExperience with security monitoring and event correlation systems (IDS/IPS, SIEM, AWS-native tooling)Knowledge of Zero Trust Architecture and its implementations (e.g., Cloudflare)Familiarity with secret management processes and toolsExperience in multi-cloud environments (AWS and preferably GCP)Understanding of business continuity principles (BIA, DRP)Professional accreditations such as AWS Security Specialty, CKS, or CISSP