Leads hands-on security engineering across detection and response, identity and access, data protection, application and cloud security, threat modeling, incident response, control assurance, and security automation. Diagnoses complex vulnerabilities and control gaps, implements preventative measures, improves security standards and workflows, leads incident exercises, and coaches colleagues. Partners with technical and business stakeholders to deliver pragmatic, risk-informed security and privacy solutions in a regulated environment.
At CFC, technology is at the heart of everything we do. We are looking for Senior Security Engineers to act as hands on problem-solvers and subject matter experts in their security and/or privacy domain, guide other people through complex issues, and lead continuous improvement of security governance, management and operations.
This is a lead individual contributor role able to both implement and verify automated controls in detection and response, identity and access, data protection, product security, or control assurance. The responsibilities below are a broad sample of security engineering across the information security function. You will be a specialist in a few and have a more general understanding and/or experience in the rest.
About the role
This is a broad selection of responsibilities across the information security function at CFC. The specific role responsibilities will depend on the individual’s background and team’s mission.
- Diagnoses and refines successful and failed detections, alerts and security logs, including network and endpoint alerts, to ensure security logging and monitoring coverage meets the needs of CFC's business objectives and its technology and threat environments.
- Leads incident response operations and continuous improvement from investigation through containment and recovery, publishes incident reports with revised playbooks.
- Designs and operates threat assessment services, including threat profiling and modelling and attack simulation, and records attack paths, threat intelligence and new requirements arising from assessments.
- Diagnoses complex chains of vulnerabilities or misconfigurations in software, application security tests, the build pipeline, malware defences, email and web protection, secure configuration or network infrastructure to root cause, and designs and implements controls to prevent recurrence.
- Produces expert guidance on the security design for a system and leads the security aspects of definitions of ready and done in projects.
- Diagnoses systemic contributing factors in conditional access, privileged access, device verification or the identity lifecycle failures, and implements the controls to prevent recurrence.
- Classifies sensitive data sets that have or will fail control coverage or effectiveness testing and implements the data protection controls to prevent recurrence, covering data loss prevention, encryption, privacy requests, insider detection and disposal.
- Evaluates control assurance, audit and continuous controls monitoring findings against the asset inventory, traces gaps, and updates standards and monitoring to prevent recurrence.
- Builds integration templates, self-serve, deterministic and non-deterministic workflow automations and analytics for repeated security tasks and coaches teams on runbooks.
- Leads incident exercises, runs tabletops against the continuity plan, and coaches CFC colleagues through awareness training and behavioural nudges.
- Experience building and maturing security standards, workflows, guidance and operational controls.
About you
We are interested in engineers who have applied their specialist technical expertise at scale and speed. You will likely bring:
- Proven experience in a technical security role, including security operations, threat detection and response, security engineering, cloud security, or application security within a fast-paced regulated organisation.
- Strong knowledge of CI/CD, cloud-native architecture, Infrastructure as Code and software supply-chain security.
- Experience leading threat modelling and resolving complex security and privacy design trade-offs.
- Ability to assess and deploy emerging data protection, AI and agentic engineering practices pragmatically and establish proportionate controls.
- Ability to influence senior technical and non-technical stakeholders through evidence, technical credibility and a pragmatic appreciation of both rigour and speed.
- Practice guiding engineers who are earlier in their career in the same domain, and coaching people through an exercise or a training session.
- Keen security mindset with excellent analytical and problem-solving skills, capable of assessing complex risks, identifying root causes, and delivering practical, threat and risk-informed solutions.
Core Values
Love what you do:
We show up each day ready to take on the world. Our passion and intensity set us apart and makes the difference to our colleagues, customers, brokers and carriers.
Challenge everything:
We’re never afraid to question the way that things are done and we constantly challenge ourselves and others to makes things better.
Have fun, be good:
Insurance is a serious business, but we don’t take ourselves too seriously. We make it fun to work at CFC, we welcome all viewpoints, and we treat everyone how we would expect to be treated.
We show up each day ready to take on the world. Our passion and intensity set us apart and makes the difference to our colleagues, customers, brokers and carriers.
Challenge everything:
We’re never afraid to question the way that things are done and we constantly challenge ourselves and others to makes things better.
Have fun, be good:
Insurance is a serious business, but we don’t take ourselves too seriously. We make it fun to work at CFC, we welcome all viewpoints, and we treat everyone how we would expect to be treated.
About
CFC is a specialist insurance provider, pioneering emerging risk and market leader in cyber. Our global insurance platform uses cutting-edge technology and data science to deliver smarter, faster underwriting and protect customers from today's most critical business risk.Headquartered in London with offices in New York, Melbourne, Sydney, Austin, Madrid, Brussels and Brisbane, CFC has over 1200 staff and is trusted by more than 100,000 businesses across 90 countries.At CFC, insurance isn't just about underwriting. From data science to software development, and digital marketing design, we've got something for everyone. We're passionate about pushing boundaries, thinking differently and building the insurance company of the future.CFC is committed to the principles of equal opportunities and creating an environment in which all individuals are always treated with dignity and respect. We encourage a diverse corporate culture of openness and appreciation to create an environment in which your talent can be developed in the best possible way. Should you require any reasonable adjustments at any stage of the recruitment process please let us know.Feeling like you need to tick every box before applying? We see things differently. In a rapidly scaling company like ours, ambition and the drive to learn count for more than a 'perfect' checklist. We're building the future of insurance, and that requires diverse talent eager to grow with us. If this role excites you and you're ready to make a significant impact, bring your unique background and let's build something great together.
CFC London, England Office
London, United Kingdom
Similar Jobs
Artificial Intelligence • Software
Own and advance security across AWS, cloud infrastructure, code, dependencies, secrets, containers, and corporate IT. The role involves maintaining security tooling, conducting security reviews, implementing code and infrastructure fixes, driving remediation, supporting ISO 27001 and SOC 2 compliance, advising on secure AI adoption, and leading security projects independently while influencing engineering teams.
Top Skills:
Ai SecurityAWSContainerized WorkloadsCspmInfrastructure As CodeSastScaSecret Scanning
Artificial Intelligence • Cloud • Computer Vision • Hardware • Internet of Things • Software
Operate and improve enterprise endpoint security, visibility, zero trust, and network access systems. Responsibilities include incident triage, anomaly investigation, policy tuning, vulnerability remediation, security documentation, cross-functional collaboration, automation with Python and SOAR platforms, and mentoring security engineers. The role supports security investigations and maintains resilient production security systems at enterprise scale.
Top Skills:
Cloud ComputingContainerizationCrowdstrikeDlpEdrEmail SecurityIamMimecast IncydrOsqueryPythonSaseSoarSplunkTerraformThreat Intelligence FeedsZero Trust
.png)
Consumer Web • eCommerce • Marketing Tech • Retail • Software • Analytics • Generative AI
Build and maintain detection-as-code, security tooling, and automated response workflows across enterprise, cloud, and product environments. Triage alerts, investigate and respond to cyber threats, conduct digital forensics and threat hunts, support security data lakes and SIEM platforms, and develop AI-first security systems. The role includes on-call participation, collaboration with threat intelligence, pipeline improvements, and mentoring other security engineers.
Top Skills:
Artificial IntelligenceCi/CdCloud PlatformsData PipelinesGitGitGoPythonSecurity Data LakesSIEMSplunkSQL
What you need to know about the London Tech Scene
London isn't just a hub for established businesses; it's also a nursery for innovation. Boasting one of the most recognized fintech ecosystems in Europe, attracting billions in investments each year, London's success has made it a go-to destination for startups looking to make their mark. Top U.K. companies like Hoptin, Moneybox and Marshmallow have already made the city their base — yet fintech is just the beginning. From healthtech to renewable energy to cybersecurity and beyond, the city's startups are breaking new ground across a range of industries.
