Senior Security Engineer

About the role

Capco is hiring a Senior Security Engineer in London (hybrid) for a permanent position. You will lead hands-on security engineering delivery for clients in financial services and other complex environments, leading a technical workstream or acting as a Principal specialist. The scope covers application and product security, cloud and platform security and DevSecOps, underpinned by strong security automation.

Key responsibilities

• Lead the design, implementation and technical assurance of secure solutions across applications, cloud platforms and delivery pipelines, staying hands-on with complex engineering and integration challenges.
• Work directly with clients to understand requirements, run technical workshops and shape security designs, delivery plans and technical proposals.
• Embed security-by-design across applications, APIs, cloud workloads and the secure SDLC through threat modelling, CI/CD controls, SAST, SCA, DAST and container scanning.
• Build and integrate scalable security automation using scripting, APIs, Infrastructure as Code and policy as code.
• Lead technical workstreams or specialist assignments, mentor engineers and develop reusable standards and patterns.
• Use approved AI-enabled tools and automation while keeping human oversight, guardrails and validation.

Required profile

• Deep implementation expertise in one or more of application and product security, cloud and platform security or DevSecOps, with working knowledge of the others.
• Practical experience securing applications, APIs, cloud workloads or engineering pipelines, with threat modelling, vulnerability management and secure SDLC knowledge.
• Broad awareness of network and infrastructure security, IAM, monitoring and data protection, able to explain technical trade-offs to clients.
• Understanding of ISO 27001, NIST and OWASP, and ability to turn security requirements into engineering controls.
• Bonus points: experience in financial services, energy or regulated sectors, and certifications such as CISSP, CSSLP, CCSP or cloud security credentials.

Required skills

• At least one major cloud platform (Azure, AWS or GCP) and cloud-native security, including IaC, containers and workload identities.
• Security automation with scripting, APIs and CI/CD tooling, plus IaC or policy as code.
• Software supply-chain or container security, technical presales or AI-enabled security engineering experience is a bonus.

What we offer

• Discretionary bonus, pension, health, life and critical illness insurance.
• Mental health support and in-house first aiders.
• Maternity, adoption, shared parental and bereavement leave, plus paid leave for other family circumstances.
• Eight complimentary backup care sessions and five weeks of annual leave.
• Minimum 40 hours of training per year and a Business Coach from Day One.
• Wellhub (Gympass), travel insurance, Tastecard, season ticket loans, Cycle to Work and dental insurance.