Senior Security Engineer (London)

Flo is the world’s #1 health app on a mission to build a better future for female health. Your role as the Security Engineer will be pivotal in supporting Flo Health’s overall security posture. Working alongside our small but powerful Security team, you will help protect our applications and infrastructure by managing vulnerabilities, responding to incidents, and implementing security measures at scale. You’ll also contribute to developing custom tooling and embedding security best practices into our product lifecycle to ensure we stay ahead of emerging threats.

What you will do:

• Developing regular touchpoints with key stakeholders.
• Manage Vulnerabilities: Triage newly discovered vulnerabilities, investigate potential risks, verify that fixes are effective, and drive remediation efforts across teams.
• Implement Security Measures: Support teams by configuring WAF rules, setting rate limits, and deploying additional controls to protect our environment.
• Develop Custom Security Tooling: Contribute to the creation and maintenance of in-house tools that enhance our security capabilities and automation.
• Product Security Support: Assist in security assessments, threat modeling, and penetration testing, working closely with the Product Security team.
• Secure Development Lifecycle: Help implement and improve security gates within the SDLC.
• Adapt & Collaborate: Be prepared to dive into any emerging security challenges.
• Investigate and triage security alerts, manage security incidents.
• Gather, curate and communicate threat intelligence.
• Support and advise business stakeholders in relation to cyber security issues.
• Generate reports for both technical and non-technical staff and stakeholders.

What you bring:

• At least 7 years of experience in the information security field.
• Hands-on experience with AWS (or similar cloud platforms) and Cloudflare.
• Infrastructure as Code: Proficiency with Terraform or similar IaC tools.
• Vulnerability Knowledge: Solid understanding of common vulnerability classes and the OWASP Top 10.
• Coding & Scripting: Proficient in reading code (e.g., Python, Scala) and using Git for version control of code and configuration changes.
• Familiarity with iOS or Android security.
• Experience of industry-standard SIEM and vulnerability scanning tools.

Nice to have:

• Experience of supporting audits such as ISO27001.
• Experience of working with security risk management frameworks such as ISO31000.
• Knowledge of security control frameworks such as CIS, NIST800-53 and ISO27001.

How we work:

We’re a mission-led, product-driven team. We move fast, stay focused and take ownership – from brief to build to impact. Debate is encouraged. Decisions are shared. We care about craft, ship with purpose, and always raise the bar.

You’ll be working with people who take their work seriously, not themselves. It takes commitment, resilience, and the drive to keep going when things get tough. Because better health outcomes are worth it.

What you’ll get:

• Competitive salary and annual reviews.
• Opportunity to participate in Flo’s performance incentive scheme.
• Paid holiday, sick leave, and female health leave.
• Enhanced parental leave and pay for maternity, paternity, same-sex and adoptive parents.
• Accelerated professional growth through world-changing work and learning support.
• Flexible office + home working, up to 2 months a year working abroad.
• 5-week fully paid sabbatical at 5-year Floversary.
• Flo Premium for friends & family, plus more health, pension and wellbeing perks.

Diversity, equity and inclusion:

Our strength is in our differences. At Flo, hiring is based on merit, skill and what you bring to the role – nothing else. We’re proud to be an equal opportunity employer, and we welcome applicants from all backgrounds, communities and identities.