Senior Product Security Engineer - Cloud & AI Guardrails

CFC; City Of London; On-site; GBP 140,000 - 190,000; Full time

Job summary

CFC is seeking a Principal Product Security Engineer in London to lead the strategy and hands-on delivery of security across cloud platforms, code and CI/CD pipelines.

You will act as a senior contributor, building secure-by-default patterns, guiding engineering teams and shaping security practices across the product portfolio, including AI-assisted and agentic development safely. This role reports to the CISO and requires deep expertise in product and cloud security.

Qualifications

• Deep experience in product, application, cloud and DevOps security.
• Proven experience implementing security tooling in production engineering environments.
• Strong knowledge of CI/CD, cloud-native architecture, Infrastructure as Code and software supply-chain security.
• Practical experience with application testing, dependency analysis, secrets detection, container and cloud posture tooling.
• Ability to write maintainable code, scripts, integrations and policy-as-code.
• Experience leading threat modelling and resolving complex security design trade-offs.
• Ability to assess emerging AI and agentic engineering practices pragmatically and establish proportionate controls.
• Ability to influence senior technical and non-technical stakeholders through evidence and technical credibility.

Responsibilities

• Design, implement and operate the product-security toolchain across source control, CI/CD, cloud and runtime environments
• Integrate and tune code, dependency, secrets, infrastructure-as-code, container and cloud security testing
• Build policy-as-code, pipeline controls and automation that prevent material weaknesses reaching production
• Secure the software supply chain through trusted dependencies, SBOMs, artefact signing, provenance and workload identity
• Lead threat modelling and security design reviews for complex products and platforms
• Diagnose vulnerabilities and misconfigurations, reduce false positives and work directly with engineers on prevention, remediation and recoverability
• Create reusable secure cloud, application and pipeline patterns that engineering teams can adopt by default
• Define and test guardrails for AI-assisted coding and agentic workflows, including identity, delegated authority, data, tools and auditability
• Measure security coverage, control effectiveness, developer experience and remediation velocity
• Act as a senior technical authority, advising stakeholders and coaching engineers setting the standard for security and data protection excellence across the wider technology organisation

Skills

Product security

Cloud security

DevOps security

CI/CD security tooling

Threat modelling

Policy-as-code

Security testing tooling

Scripting / coding

Stakeholder influence

Job description

CFC is seeking a Principal Product Security Engineer in London to lead the strategy and hands-on delivery of security across cloud platforms, code and CI/CD pipelines.

You will act as a senior contributor, building secure-by-default patterns, guiding engineering teams and shaping security practices across the product portfolio, including AI-assisted and agentic development safely. This role reports to the CISO and requires deep expertise in product and cloud security.