Staff Security Engineer

CFC; Greater London; On-site; GBP 90,000 - 140,000; Full time

Job summary

CFC in London is seeking a Staff Security Engineer to advance security capabilities across our global technology estate. You will design security observability, automate control assurance and embed strong controls into products, platforms and processes.

This senior individual contributor role requires deep security expertise, cross‑team collaboration and a proven ability to translate security data into actionable insight and measurable risk reduction.

Qualifications

• Experience in security engineering, governance, risk or compliance.
• Proven ability to build automated security solutions in modern cloud environments.
• Familiarity with SIEM, vulnerability management, data protection, and endpoint security.

Responsibilities

• Designing and building security observability across systems, infrastructure and applications.
• Developing automated control monitoring, evidence collection and continuous testing solutions.
• Partnering with engineering, data and technology teams to embed security controls into products and platforms.
• Driving improvements in security event monitoring, exposure management and alerting capabilities.
• Conducting security reviews of new products and technology initiatives.
• Building meaningful security metrics and reporting to support decision-making.
• Evolving security policies and guardrails through automation and measurable outcomes.
• Contributing to access governance and control assurance across identities.

Skills

Security engineering

Cloud security

SIEM

Automation

APIs

IaC

Cloud platforms (Azure/AWS/GCP)

Security standards (ISO 27001/SOC 2/CI

Regulated environments

Communication

Job description

Staff Security Engineer

Department: CISO

Employment Type: Permanent - Full Time

Location: UK - London

At CFC, technology is at the heart of everything we do. As a market leader in cyber insurance and a business built on innovation, we're looking for a Staff Security Engineer to play a critical role in evolving our security capabilities and driving measurable risk reduction across our global technology estate.

This is a senior individual contributor opportunity for an engineer who enjoys solving complex security challenges at scale. You'll work across engineering, data, AI and digital workplace teams to build security observability, automate control assurance and influence how security is embedded into products, platforms and processes.

If you're passionate about turning security data into actionable insight, building elegant automation and raising the security maturity of a fast-moving technology organisation, we'd love to hear from you.

About the role

• Designing and building security observability capabilities that provide meaningful visibility across systems, infrastructure and applications
• Developing automated control monitoring, evidence collection and continuous testing solutions that strengthen security governance
• Partnering with engineering, data and technology teams to embed effective security controls into products and platforms
• Driving improvements in security event monitoring, exposure management and alerting capabilities
• Conducting security reviews of new products, services and technology initiatives
• Building meaningful security metrics and reporting that support informed decision-making
• Supporting the evolution of security policies, standards and technical guardrails through automation and measurable outcomes
• Contributing to access governance and security control assurance activities across both human and non-human identities

Acting as a technical leader and trusted security advisor, helping raise standards across the wider technology organisation

About you

We're interested in hearing from engineers who combine strong technical depth with a practical, collaborative approach to security.

You’ll likely bring:

• A strong background in security engineering, information security, governance, risk or compliance
• Experience building security controls and automated security solutions within modern cloud environments
• Knowledge of security technologies such as SIEM, vulnerability management, data protection, endpoint security or exposure management platforms
• Experience working with APIs, automation, scripting and infrastructure-as-code technologies
• Familiarity with cloud platforms including Azure, AWS or GCP
• An understanding of security frameworks and control standards such as ISO 27001, SOC 2 and CIS Controls
• Experience operating in regulated environments and working with security and data protection requirements
• Excellent communication skills and the ability to influence stakeholders across technical and non-technical teams