Principal Product Security Engineer
LondonHybrid
AI Summary
Leads product security strategy and hands-on delivery across cloud platforms, code, and CI/CD pipelines as a principal individual contributor, advising engineering and shaping secure-by-default patterns.
About this role
At CFC, technology is at the heart of everything we do. We are looking for a Principal Product Security Engineer to lead the strategy and hands-on delivery of security across cloud platforms, code and CI/CD pipelines.
This is a lead individual contributor role for an engineer who solves unique, high-impact problems, advises across disciplines and helps shape functional strategy. You will lead the build and operation of the product-security toolchain, create secure-by-default patterns and influence how security is embedded across engineering.
You will also help CFC adopt AI-assisted and agentic product engineering safely. As these practices develop, you will use proportionate guardrails, controlled experimentation and evidence-led assurance rather than assume settled industry practice.
Key Responsibilities
- Design, implement and operate the product-security toolchain across source control, CI/CD, cloud and runtime environments
- Integrate and tune code, dependency, secrets, infrastructure-as-code, container and cloud security testing
- Build policy-as-code, pipeline controls and automation that prevent material weaknesses reaching production
- Secure the software supply chain through trusted dependencies, SBOMs, artefact signing, provenance and workload identity
- Lead threat modelling and security design reviews for complex products and platforms
- Diagnose vulnerabilities and misconfigurations, reduce false positives and work directly with engineers on prevention, remediation and recoverability
- Create reusable secure cloud, application and pipeline patterns that engineering teams can adopt by default
- Define and test guardrails for AI-assisted coding and agentic workflows, including identity, delegated authority, data, tools and auditability
- Measure security coverage, control effectiveness, developer experience and remediation velocity
- Act as a senior technical authority, advising stakeholders and coaching engineers setting the standard for security and data protection excellence across the wider technology organisation
Skills, Knowledge & Expertise
We are interested in engineers who combine principal-level judgement with sustained hands-on delivery. You'll likely bring:
- Deep experience in product, application, cloud and DevOps security
- Proven experience implementing security tooling in production engineering environments
- Strong knowledge of CI/CD, cloud-native architecture, Infrastructure as Code and software supply-chain security
- Practical experience with application testing, dependency analysis, secrets detection, container and cloud posture tooling
- Ability to write maintainable code, scripts, integrations and policy-as-code
- Experience leading threat modelling and resolving complex security design trade-offs
- Ability to assess emerging AI and agentic engineering practices pragmatically and establish proportionate controls
- Ability to influence senior technical and non-technical stakeholders through evidence and technical credibility
Benefits
Love what you do:
We show up each day ready to take on the world. Our passion and intensity set us apart and makes the difference to our colleagues, customers, brokers and carriers.
Challenge everything:
We’re never afraid to question the way that things are done and we constantly challenge ourselves and others to makes things better.
Have fun, be good:
Insurance is a serious business, but we don’t take ourselves too seriously. We make it fun to work at CFC, we welcome all viewpoints, and we treat everyone how we would expect to be treated.
We show up each day ready to take on the world. Our passion and intensity set us apart and makes the difference to our colleagues, customers, brokers and carriers.
Challenge everything:
We’re never afraid to question the way that things are done and we constantly challenge ourselves and others to makes things better.
Have fun, be good:
Insurance is a serious business, but we don’t take ourselves too seriously. We make it fun to work at CFC, we welcome all viewpoints, and we treat everyone how we would expect to be treated.
Skills
AI-assisted Coding GuardrailsApplication TestingArtefact SigningCI/CDCloud-native ArchitectureCloud Posture ToolingContainer SecurityDependency AnalysisInfrastructure As CodePolicy-as-codeSBOMSecrets DetectionSoftware Supply-chain SecurityThreat ModellingWorkload Identity
Explore related jobs
More jobs at Cfc
Similar AI-assisted Coding Guardrails jobs
Jobs in London
- HUrban Outfitters Merchandising Admin Assistant (12 Month FTC) - Future OpportunitiesHomeoffice Eu Urbn · London, United Kingdom
- PHygienist Laurel Dental CarePepperpointe · London, KY
- OPrincipal| Leadership Advisory | LondonOdgersberndtson · London, United Kingdom
- OPrincipal| Leadership Advisory | LondonOdgersinterim · London, United Kingdom
- MAssociate, Commercial Real Estate Debt (London)Marathonfund · London, United Kingdom
- MVice President, Commercial Real Estate Debt (London)Marathonfund · London, United Kingdom
Browse these categories
Market data for security engineer roles
All reports →- SeriesRole reportsOne role family at a time: how many openings, what changed this week, who is hiring, what it pays.
- SeriesSalary reportsWhat employers publish in job postings, by level and workplace. Not self-reported pay.
- Market overviewState of tech hiring, September 2026: up 4.8%Tech hiring rose 4.8% month over month in September 2026, with 411,122 new listings. Customer support and account executive roles led the growth.