CFC

Cyber risk underwriting through MGA platform

Lead Security Engineer - Data

Security Engineering & ArchitectureUpdated on Nov 13

Full-timeLondon, UKNo salary listedHybrid

About the Job

Requirements

Deep experience designing and engineering privacy and security for a fast-moving, technology-forward organisation.
Experience designing classification, loss-prevention, sandboxing, monitoring, encryption, disposal, and reporting controls that other teams can apply.
A record of closing data-loss or insider investigations with a control that prevents the same failure from recurring.
Experience handling sensitive investigations with appropriate discretion, including evidence collection, chain of custody, and close working with HR, Legal, and other authorised stakeholders.
Experience designing access and permissions for human and non-human users to production data and addressing privacy and security weaknesses.
Ability to create privacy and security architectures and navigate trade-offs between compliance, security, accessibility, decentralisation, and performance.
Ability to automate privacy and security controls through code, policy, and workflow automation.
Strong technical judgement and the ability to influence cross-functional teams through clear architectural reasoning.

Responsibilities

Design, implement, and operate data discovery, classification, and loss-prevention controls across CFC's data stores, and record coverage in the control register.
Create reusable patterns for encryption, masking, and secure disposal, and publish them as standards for new systems.
Implement data-loss-prevention policy-as-code for email, endpoints, and cloud stores, and record test results for each rule change.
Diagnose insider and data-loss incidents to root cause, implement controls to prevent recurrence, and document findings in incident reports.
Preserve and prepare digital evidence for insider, data-loss, and sensitive investigations, maintaining chain of custody and applying recognised digital evidence principles.
Lead cross-functional data-protection design reviews for new products and record decisions as standards.
Design technical guardrails for data handling, including generative AI tools, and publish the guardrail catalogue in the standard.
Build security metrics for classification coverage, loss-prevention events, and encryption of sensitive stores, and publish them to data owners.
Advise the security function on data-protection exceptions and record each decision in the risk register.
Lead cross-functional data privacy and security design and threat-modelling activities, translating identified risks into layered, prioritised engineering improvements.
Design and implement automation for privacy and security policies and guardrails across workflows and endpoints, including the use of AI augmentation.
Serve as the technical authority on data privacy and security, advising teams on complex privacy and security architecture and right-sizing controls.

At CFC, technology is at the heart of everything we do. We are looking for a Lead Security Engineer (Data) to design and deliver data protection across CFC's systems, products and ways of working. This is an individual contributor leader role for an engineer who solves complex, cross-functional problems and turns security and privacy requirements into effective technical controls.

You will work with engineering, data, privacy and the business to create reusable patterns, policy-as-code, implement and automate controls, diagnose weaknesses and ensure data protection remains effective as our technology environment evolves.

In this role, you will:

Design, implement and operate data discovery, classification and loss-prevention controls across CFC's stores, and record coverage in the control register.
Create reusable patterns for encryption, masking and secure disposal, and publish them as standards for new systems.
Implement data-loss-prevention policy-as-code for email, endpoints and cloud stores, and record the test results for each rule change.
Diagnose insider and data-loss incidents to root cause, implement the control to prevent recurrence, and document both in the incident report.
Preserve and prepare digital evidence for insider, data-loss and sensitive investigations, maintaining chain of custody and applying recognised digital evidence principles.
Lead cross-functional data-protection design reviews for new products and record the decisions as standards.
Design technical guardrails for data handling, including generative AI tools, and publish the guardrail catalogue in the standard.
Build security metrics for classification coverage, loss-prevention events and encryption of sensitive stores, and publish them to data owners.
Advise the security function on data-protection exceptions and record each decision in the risk register.
Lead cross-functional data privacy and security design and threat-modelling activities, translating identified risks into layered, prioritised engineering improvements.
Design and implement automation for privacy and security policies and guardrails across workflows and endpoints, including use of AI augmentation.
Be the technical authority on data privacy and security, advising teams on complex privacy and security architecture and right-sizing controls.

You'll likely bring:

Deep experience designing and engineering privacy and security for a fast-moving technology forward organisation.
Experience designing classification, loss prevention, sandboxing, monitoring, encryption, disposal and reporting controls that other teams can apply
A record of data-loss or insider investigations closed with a control that stopped the same failure returning.
Experience handling sensitive investigations with appropriate discretion, including evidence collection, chain of custody and close working with HR, Legal and other authorised stakeholders.
Experience designing access and permissions for both human and non-humans to production data and addressing privacy and security weaknesses.
Ability to create privacy and security architectures and navigate trade-offs between compliance, security, accessibility, decentralisation and performance.
Ability to automate privacy and security controls through code, policy and workflow automation.
Strong technical judgement and the ability to influence cross-functional teams through clear architectural reasoning.

About the Company

CFC

Cyber risk underwriting through MGA platform

CFC Underwriting is a specialist insurance provider operating as a managing general agent (MGA) that underwrites on behalf of a panel of carriers, focusing on emerging and specialty risks with a strong emphasis on cyber. It uses a proprietary global insurance platform powered by data science to streamline underwriting across a portfolio of 50+ products, including cyber and professional liability, with an in-house incident response team adding comprehensive cyber risk management. It differentiates itself through its early focus on cyber, large in-house claims and incident response capabilities, and a global broker-driven distribution model. Its goal is to deliver fast, precise underwriting and robust risk management for technology-related and other specialty risks worldwide.

Company size: 1,001-5,000
Company stage: Not listed
Total funding: Not listed
Headquarters: London, United Kingdom
Founded: 1999

Recently Posted Jobs

Explore more opportunities at CFC

See more jobs