C

CFC

Cyber risk underwriting through MGA platform

Principal Product Security Engineer

Security Engineering & ArchitectureUpdated on Nov 13
Full-timeLondon, UKNo salary listedHybrid

About the Job

Requirements

  • Deep experience in product, application, cloud, and DevOps security.
  • Proven experience implementing security tooling in production engineering environments.
  • Strong knowledge of CI/CD, cloud-native architecture, Infrastructure as Code, and software supply-chain security.
  • Practical experience with application testing, dependency analysis, secrets detection, container security, and cloud posture tooling.
  • Ability to write maintainable code, scripts, integrations, and policy-as-code.
  • Experience leading threat modelling and resolving complex security design trade-offs.
  • Ability to assess emerging AI and agentic engineering practices pragmatically and establish proportionate controls.
  • Ability to influence senior technical and non-technical stakeholders through evidence and technical credibility.

Responsibilities

  • Design, implement, and operate the product-security toolchain across source control, CI/CD, cloud, and runtime environments.
  • Integrate and tune code, dependency, secrets, infrastructure-as-code, container, and cloud security testing.
  • Build policy-as-code, pipeline controls, and automation that prevent material weaknesses from reaching production.
  • Secure the software supply chain through trusted dependencies, software bills of materials (SBOMs), artefact signing, provenance, and workload identity.
  • Lead threat modelling and security design reviews for complex products and platforms.
  • Diagnose vulnerabilities and misconfigurations, reduce false positives, and work directly with engineers on prevention, remediation, and recoverability.
  • Create reusable secure cloud, application, and pipeline patterns that engineering teams can adopt by default.
  • Define and test guardrails for AI-assisted coding and agentic workflows, including identity, delegated authority, data, tools, and auditability.
  • Measure security coverage, control effectiveness, developer experience, and remediation velocity.
  • Act as a senior technical authority, advise stakeholders, and coach engineers, setting the standard for security and data protection excellence across the wider technology organisation.
  • Lead the strategy and hands-on delivery of security across cloud platforms, code, and CI/CD pipelines.
  • Lead the build and operation of the product-security toolchain, create secure-by-default patterns, and influence how security is embedded across engineering.
  • Help CFC adopt AI-assisted and agentic product engineering safely using proportionate guardrails, controlled experimentation, and evidence-led assurance.

About the Company

CFC

Cyber risk underwriting through MGA platform

CFC Underwriting is a specialist insurance provider operating as a managing general agent (MGA) that underwrites on behalf of a panel of carriers, focusing on emerging and specialty risks with a strong emphasis on cyber. It uses a proprietary global insurance platform powered by data science to streamline underwriting across a portfolio of 50+ products, including cyber and professional liability, with an in-house incident response team adding comprehensive cyber risk management. It differentiates itself through its early focus on cyber, large in-house claims and incident response capabilities, and a global broker-driven distribution model. Its goal is to deliver fast, precise underwriting and robust risk management for technology-related and other specialty risks worldwide.

Company size
1,001-5,000
Company stage
Not listed
Total funding
Not listed
Headquarters
London, United Kingdom
Founded
1999

Recently Posted Jobs

Explore more opportunities at CFC

See more jobs