Staff Security Engineer

CFC Underwriting; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

CFC Underwriting seeks a Staff Security Engineer to advance security observability and automate controls across our global technology estate. You will partner with engineering and data teams to embed security into products, platforms and processes while driving measurable risk reduction at scale.

This senior IC role focuses on solving complex security challenges, turning security data into actionable insights, and raising the security maturity of a fast-moving technology organisation.

Qualifications

• Strong background in security engineering, information security, governance, risk or compliance.
• Experience building security controls and automated security solutions in modern cloud environments.
• Familiarity with cloud platforms (Azure, AWS, GCP) and security frameworks.
• Experience with APIs, automation, scripting and infrastructure-as-code.

Responsibilities

• Designing and building security observability capabilities across systems, infrastructure and applications.
• Developing automated control monitoring and continuous testing solutions for governance.
• Partnering with engineering, data and technology teams to embed security controls into products and platforms.
• Improving security event monitoring, exposure management and alerting capabilities.
• Conducting security reviews of new products and initiatives.
• Building security metrics and reporting to support decision-making.
• Evolving security policies, standards and guardrails through automation and measurable outcomes.
• Contributing to access governance and security control assurance across identities.

Skills

Security engineering

Information security

Governance & compliance

Cloud security

Tools

SIEM

Vulnerability management

Data protection

Endpoint security

Exposure management

Job description

Staff Security Engineer

At CFC, technology is at the heart of everything we do. As a market leader in cyber insurance and a business built on innovation, we’re looking for a Staff Security Engineer to play a critical role in evolving our security capabilities and driving measurable risk reduction across our global technology estate.

This is a senior individual contributor opportunity for an engineer who enjoys solving complex security challenges at scale. You’ll work across engineering, data, AI and digital workplace teams to build security observability, automate control assurance and influence how security is embedded into products, platforms and processes.

If you're passionate about turning security data into actionable insight, building elegant automation and raising the security maturity of a fast-moving technology organisation, we'd love to hear from you.

About the role

• Designing and building security observability capabilities that provide meaningful visibility across systems, infrastructure and applications
• Developing automated control monitoring, evidence collection and continuous testing solutions that strengthen security governance
• Partnering with engineering, data and technology teams to embed effective security controls into products and platforms
• Driving improvements in security event monitoring, exposure management and alerting capabilities
• Conducting security reviews of new products, services and technology initiatives
• Building meaningful security metrics and reporting that support informed decision-making
• Supporting the evolution of security policies, standards and technical guardrails through automation and measurable outcomes
• Contributing to access governance and security control assurance activities across both human and non-human identities

Acting as a technical leader and trusted security advisor, helping raise standards across the wider technology organisation.

About you

We're interested in hearing from engineers who combine strong technical depth with a practical, collaborative approach to security.

• A strong background in security engineering, information security, governance, risk or compliance
• Experience building security controls and automated security solutions within modern cloud environments
• Knowledge of security technologies such as SIEM, vulnerability management, data protection, endpoint security or exposure management platforms
• Experience working with APIs, automation, scripting and infrastructure-as-code technologies
• Familiarity with cloud platforms including Azure, AWS or GCP
• An understanding of security frameworks and control standards such as ISO 27001, SOC 2 and CIS Controls
• Experience operating in regulated environments and working with security and data protection requirements
• Excellent communication skills and the ability to influence stakeholders across technical and non-technical teams