Senior AppSec & Cloud Security Engineer — AWS

Financial Times; Taguig; On-site; PHP 7,304,000 - 10,956,000; Full time

Job summary

Financial Times is seeking a Senior Cyber Security Engineer to mature application and cloud security across our cloud-native, AWS-hosted technology estate. This role balances applying guardrails with hands-on engineering work to make secure delivery easier by default.

You will review designs, lead threat modelling sessions, and drive remediation across vulnerabilities and misconfigurations, while mentoring a small team of security engineers as needed.

Qualifications

• Hands-on AWS security experience with practical remediation.
• Experience tuning SAST and software composition analysis in CI/CD.
• Ability to write small security tools or scripts, preferably in Python.
• Experience mentoring security engineers and collaborating with product teams.
• Knowledge of AI-enabled security improvements is a plus.

Responsibilities

• Improve application security guardrails with actionable controls.
• Improve cloud and IaC security guardrails at scale.
• Drive vulnerability management across engineering teams.
• Drive cloud misconfiguration management and remediation.
• Run practical threat modelling sessions for new products.
• Build automation, dashboards and tooling to reduce toil.
• Support secure architecture decisions in design reviews.
• Partner with engineering to embed security into delivery.
• Support incidents and capture lessons learned; mentor others.

Skills

AWS security

SAST

Software composition analysis

IaC scanning

Threat modelling

CI/CD security

Python scripting

Security mentorship

AI security awareness

Job description

Financial Times is seeking a Senior Cyber Security Engineer to mature application and cloud security across our cloud-native, AWS-hosted technology estate. This role balances applying guardrails with hands-on engineering work to make secure delivery easier by default.

You will review designs, lead threat modelling sessions, and drive remediation across vulnerabilities and misconfigurations, while mentoring a small team of security engineers as needed.