17 hours ago
London, United KingdomStaff+
Responsibilities
- Design, implement, and operate the product-security toolchain across source control, CI/CD, cloud, and runtime environments.
- Integrate and tune code, dependency, secrets, infrastructure-as-code, container, and cloud security testing.
- Build policy-as-code, pipeline controls, and automation to prevent material weaknesses from reaching production.
- Secure the software supply chain through trusted dependencies, SBOMs, artifact signing, provenance, and workload identity.
- Lead threat modeling and security design reviews for complex products and platforms.
- Diagnose vulnerabilities and misconfigurations, reduce false positives, and partner with engineers on prevention, remediation, and recoverability.
- Create reusable secure cloud, application, and pipeline patterns for engineering teams.
- Define and test guardrails for AI-assisted coding and agentic workflows, including identity, delegated authority, data, tools, and auditability.
- Measure security coverage, control effectiveness, developer experience, and remediation velocity.
- Advise stakeholders, coach engineers, and act as a senior technical authority for security and data protection.
Requirements
- Deep experience in product, application, cloud, and DevOps security.
- Proven experience implementing security tooling in production engineering environments.
- Strong knowledge of CI/CD, cloud-native architecture, infrastructure as code, and software supply-chain security.
- Practical experience with application testing, dependency analysis, secrets detection, container security, and cloud posture tooling.
- Ability to write maintainable code, scripts, integrations, and policy-as-code.
- Experience leading threat modeling and resolving complex security design trade-offs.
- Ability to assess emerging AI and agentic engineering practices and establish proportionate controls.
- Ability to influence senior technical and non-technical stakeholders through evidence and technical credibility.
Categories
About CFC
CFC is a London‑headquartered specialist insurer that builds technology‑driven products for businesses, with particular strength in cyber and other emerging risks. Founded in 1999, it underwrites lines including cyber, intellectual property, management liability, medical malpractice, product recall, and property & casualty, distributed primarily through brokers worldwide. CFC serves customers in over 90 countries and offers coordinated incident response to help clients manage cyber incidents from notification to resolution.