Developer-First Application Security Engineer

Financial Times; London; Hybrid; NOK 819,000 - 1,134,000; Full time

Benefits offered by this job

Hybrid work model

Medical cover

Parental leave

Job summary

The Financial Times is seeking a Cyber Security Engineer to strengthen application security across our cloud-native technology estate. You’ll enable secure engineering practices for product, platform and software teams, focusing on guardrails in CI/CD pipelines, repositories and workflows.

You’ll work with engineers to enable threat modelling, vulnerability triage and pragmatic remediation, with exposure to AWS or cloud security helpful but not essential.

Qualifications

• Practical experience in application security.
• Experience working with software engineers to explain and remediate security issues.
• Familiarity with common web application security risks and secure coding practices.
• Experience with vulnerability triage, prioritisation and remediation tracking.
• Experience using or interpreting findings from tools such as SAST, software composition analysis, secret scanning or similar.
• Experience participating in or supporting threat‑modelling activities.
• Ability to write scripts or small tools, ideally in Python, to automate tasks or improve visibility.
• Strong communication and collaboration skills.
• Familiarity with Agile or Scrum ways of working.
• Exposure to AWS security, cloud security or infrastructure‑as‑code security.
• Experience with Terraform or CloudFormation.
• Experience with container or Kubernetes security.
• Experience with bug bounty, penetration testing or security testing programmes.
• Experience with Splunk or similar logging/SIEM platforms.
• Exposure to AI security, such as LLM‑enabled applications, AI‑assisted development workflows or prompt/data leakage risks.
• Experience building dashboards, metrics or reports to support vulnerability management.
• Relevant security certifications or training, such as AWS security training, secure coding training, GIAC, ISC2, CREST or equivalent practical experience.

Responsibilities

• Improve application security across the FT’s cloud-native technology estate.
• Help improve developer‑friendly security guardrails across GitHub‑based CI/CD pipelines, application repositories and engineering workflows.
• Support practical threat modelling, triage application vulnerabilities and remediate issues pragmatically.
• Collaborate with engineers to grow tooling and make security an everyday part of delivery.

Skills

Application security

Threat modelling

CI/CD security

Automation scripting

Cloud security

Communication skills

Agile/Scrum

Python scripting

Tools

Terraform

CloudFormation

Kubernetes

Splunk

SAST tooling

Job description

The Financial Times is seeking a Cyber Security Engineer to strengthen application security across our cloud-native technology estate. You’ll enable secure engineering practices for product, platform and software teams, focusing on guardrails in CI/CD pipelines, repositories and workflows.

You’ll work with engineers to enable threat modelling, vulnerability triage and pragmatic remediation, with exposure to AWS or cloud security helpful but not essential.