CFC

Cyber risk underwriting through MGA platform

Senior Security Engineer

Security Engineering & ArchitectureUpdated on Nov 13

Full-timeLondon, UKNo salary listedHybrid

About the Job

Requirements

Proven experience in a technical security role, including security operations, threat detection and response, security engineering, cloud security, or application security within a fast-paced regulated organisation.
Strong knowledge of CI/CD, cloud-native architecture, Infrastructure as Code, and software supply-chain security.
Experience leading threat modelling and resolving complex security and privacy design trade-offs.
Ability to assess and deploy emerging data protection, AI, and agentic engineering practices pragmatically and establish proportionate controls.
Practice guiding engineers who are earlier in their career in the same domain and coaching people through an exercise or training session.
Ability to assess complex risks, identify root causes, and deliver practical, threat- and risk-informed solutions.

Responsibilities

Diagnose and refine successful and failed detections, alerts, and security logs, including network and endpoint alerts, to ensure security logging and monitoring coverage meets business objectives and the technology and threat environments.
Lead incident response operations and continuous improvement from investigation through containment and recovery, and publish incident reports with revised playbooks.
Design and operate threat assessment services, including threat profiling and modelling and attack simulation, and record attack paths, threat intelligence, and new requirements arising from assessments.
Diagnose complex chains of vulnerabilities or misconfigurations in software, application security tests, the build pipeline, malware defences, email and web protection, secure configuration, or network infrastructure to root cause, and design and implement controls to prevent recurrence.
Produce expert guidance on the security design for a system and lead the security aspects of definitions of ready and done in projects.
Diagnose systemic contributing factors in conditional access, privileged access, device verification, or identity lifecycle failures, and implement controls to prevent recurrence.
Classify sensitive data sets that have or will fail control coverage or effectiveness testing and implement data protection controls to prevent recurrence, covering data loss prevention, encryption, privacy requests, insider detection, and disposal.
Evaluate control assurance, audit, and continuous controls monitoring findings against the asset inventory, trace gaps, and update standards and monitoring to prevent recurrence.
Build integration templates, self-serve workflows, deterministic and non-deterministic workflow automations, and analytics for repeated security tasks, and coach teams on runbooks.
Lead incident exercises, run tabletops against the continuity plan, and coach colleagues through awareness training and behavioural nudges.
Build and mature security standards, workflows, guidance, and operational controls.

At CFC, technology is at the heart of everything we do. We are looking for Senior Security Engineers to act as hands on problem-solvers and subject matter experts in their security and/or privacy domain, guide other people through complex issues, and lead continuous improvement of security governance, management and operations.

This is a lead individual contributor role able to both implement and verify automated controls in detection and response, identity and access, data protection, product security, or control assurance. The responsibilities below are a broad sample of security engineering across the information security function. You will be a specialist in a few and have a more general understanding and/or experience in the rest.

This is a broad selection of responsibilities across the information security function at CFC. The specific role responsibilities will depend on the individual’s background and team’s mission.

Diagnoses and refines successful and failed detections, alerts and security logs, including network and endpoint alerts, to ensure security logging and monitoring coverage meets the needs of CFC's business objectives and its technology and threat environments.
Leads incident response operations and continuous improvement from investigation through containment and recovery, publishes incident reports with revised playbooks.
Designs and operates threat assessment services, including threat profiling and modelling and attack simulation, and records attack paths, threat intelligence and new requirements arising from assessments.
Diagnoses complex chains of vulnerabilities or misconfigurations in software, application security tests, the build pipeline, malware defences, email and web protection, secure configuration or network infrastructure to root cause, and designs and implements controls to prevent recurrence.
Produces expert guidance on the security design for a system and leads the security aspects of definitions of ready and done in projects.
Diagnoses systemic contributing factors in conditional access, privileged access, device verification or the identity lifecycle failures, and implements the controls to prevent recurrence.
Classifies sensitive data sets that have or will fail control coverage or effectiveness testing and implements the data protection controls to prevent recurrence, covering data loss prevention, encryption, privacy requests, insider detection and disposal.
Evaluates control assurance, audit and continuous controls monitoring findings against the asset inventory, traces gaps, and updates standards and monitoring to prevent recurrence.
Builds integration templates, self-serve, deterministic and non-deterministic workflow automations and analytics for repeated security tasks and coaches teams on runbooks.
Leads incident exercises, runs tabletops against the continuity plan, and coaches CFC colleagues through awareness training and behavioural nudges.
Experience building and maturing security standards, workflows, guidance and operational controls.

We are interested in engineers who have applied their specialist technical expertise at scale and speed. You will likely bring:

Proven experience in a technical security role, including security operations, threat detection and response, security engineering, cloud security, or application security within a fast-paced regulated organisation.
Strong knowledge of CI/CD, cloud-native architecture, Infrastructure as Code and software supply-chain security.
Experience leading threat modelling and resolving complex security and privacy design trade-offs.
Ability to assess and deploy emerging data protection, AI and agentic engineering practices pragmatically and establish proportionate controls.
Ability to influence senior technical and non-technical stakeholders through evidence, technical credibility and a pragmatic appreciation of both rigour and speed.
Practice guiding engineers who are earlier in their career in the same domain, and coaching people through an exercise or a training session.
Keen security mindset with excellent analytical and problem-solving skills, capable of assessing complex risks, identifying root causes, and delivering practical, threat and risk-informed solutions.

About the Company

CFC

Cyber risk underwriting through MGA platform

CFC Underwriting is a specialist insurance provider operating as a managing general agent (MGA) that underwrites on behalf of a panel of carriers, focusing on emerging and specialty risks with a strong emphasis on cyber. It uses a proprietary global insurance platform powered by data science to streamline underwriting across a portfolio of 50+ products, including cyber and professional liability, with an in-house incident response team adding comprehensive cyber risk management. It differentiates itself through its early focus on cyber, large in-house claims and incident response capabilities, and a global broker-driven distribution model. Its goal is to deliver fast, precise underwriting and robust risk management for technology-related and other specialty risks worldwide.

Company size: 1,001-5,000
Company stage: Not listed
Total funding: Not listed
Headquarters: London, United Kingdom
Founded: 1999

Recently Posted Jobs

Explore more opportunities at CFC

See more jobs