At a Glance
- Tasks: Lead platform security practices and mentor teams in a dynamic environment.
- Company: Join Hiscox, a forward-thinking company focused on growth and innovation.
- Benefits: Enjoy competitive salary, inclusive culture, and opportunities for professional development.
- Other info: Be part of a diverse team that values continuous improvement and collaboration.
- Why this job: Make a real impact on security practices while working with cutting-edge technology.
- Qualifications: 5+ years in DevOps/Platform Engineering with strong leadership skills.
The predicted salary is between 63000 - 77000 £ per year.
Build a brilliant future with Hiscox. As a senior and influential member of the London Platform Engineering Chapter, the Principal Platform Security Engineer will set direction and lead by example in maturing our platform security practices. You will guide multiple Innovation squads and Engineering Chapters, driving cloud-first adoption and championing secure-by-design initiatives.
You will be an integral member of a Chapter spanning Platform, DevOps, and Site Reliability Engineers, and a core contributor to a Platform Engineering squad focused on continuous improvement across our cloud and on-premises platforms. You will raise engineering standards through automation, reliable design, and pragmatic governance, helping to deliver smarter, more cost-effective, and faster solutions that are reusable across squads.
With security embedded across all squads, you will provide visible leadership to strengthen our platform security posture. You will influence priorities, drive the change needed to embed modern DevOps and security ways of working, and ensure teams have the patterns, tooling, and guidance to succeed.
As the chapter grows, this role also offers the opportunity to take on people leadership responsibilities, including day-to-day management of third-party security engineers and partner resources.
Key Responsibilities- Coach and mentor chapter members, and support the Head of Platform Engineering with overall chapter management, particularly across partner resources.
- Design, implement, and automate security controls and security testing within the SDLC.
- Lead application security practices, ensuring secure design and build, and coordinate effectively between engineering and security teams.
- Apply Security-as-Code principles by providing training, creating reusable patterns, and establishing best practices for teams.
- Support the investigation and future implementation of agentic workflows and agents, ensuring proposed solutions are secure-by-design and comply with Hiscox AI governance.
- Respond swiftly to new and emerging security threats and vulnerabilities, investigate suspected attacks, and help manage security incidents, including post-incident reviews to identify root causes, implement solutions, and prevent recurrence.
- Produce clear, actionable security reporting for senior leadership.
- Act as the primary point of contact for security-related inquiries across London Market technology and change initiatives, coordinating with Group, other Business Units, and Cyber teams to advance security practices across Hiscox.
- Influence key architectural decisions early, balancing business requirements, budgets, security, and resilience.
- Partner with squads to take solutions from proof of concept (PoC) through to a production-ready platform.
- Build and maintain secure Azure and GCP infrastructure across all environments using Azure DevOps Pipelines and Terraform.
- Oversee and coach squads on intra-day deployment mechanisms, advocating for cloud-informed improvements that increase security, reliability, and delivery speed.
- Build and maintain monitoring and alerting at all levels (infrastructure, application, and data), ensuring actionable signals and secure operational practices.
- 5+ years’ DevOps/Platform Engineering experience delivering solutions in Azure and/or GCP.
- Full-stack application and infrastructure solution design, ensuring robust security controls, high availability, and operational resilience throughout.
- Working knowledge of vulnerability and compliance management (scanning through to remediation), patch management, endpoint protection/anti-malware, and access control management (e.g., IAM/PAM), including driving findings to closure.
- Working knowledge of threat modelling and risk assessment, applied to cloud architectures and CI/CD pipelines to guide secure design and prioritised risk treatment.
- Experience with AppSec tooling, including CI/CD integration, tuning to reduce noise, and triaging results with engineers to prioritise remediation and prevent regressions.
- Strong leadership skills. You will help lead the wider technology and change teams to improve our DevOps and Security maturity by educating others and delegating responsibilities across your chapter, other engineering chapters, and Group IT teams.
- Experience with Terraform, and platform solutions.
- Experience working on solutions with integrations between GCP and Azure.
- Knowledge of Cloud native, microservices and containerised systems.
- To have a strong desire for continuous improvement and an Agile way of working.
- Knowledge of the insurance and London Market ecosystem; Lloyd’s market experience is particularly valuable.
- Proven, hands-on software delivery experience, including platform engineering and/or build, release, and deployment engineering using modern DevOps practices.
- Experience delivering and operating technology in regulated environments, with a strong understanding of controls, audit expectations, and evidence-based compliance.
- Able to clearly explain the processes, patterns, and tooling used to ensure quality, stability, performance, scalability, secure deployment, maintainability, and effective documentation.
- Broad awareness of major cloud providers and services, with curiosity to evaluate and adopt capabilities that improve security, reliability, and cost efficiency.
- Proactive and improvement-focused, challenging the status quo and driving automation and simplification wherever it adds value.
- Strong delivery focus, able to prioritise effectively and deliver outcomes in a fast-paced environment with shifting demands.
- Able to operate effectively in a small, high-impact team while collaborating across a wider product/engineering organisation.
- Excellent communication and stakeholder-management skills, able to influence at all levels and present complex topics clearly.
- Comfortable working in ambiguity and adapting quickly as priorities, technology, and threats evolve.
- Up-to-date knowledge of security practices, processes, and tooling, with the judgement to apply emerging approaches pragmatically.
This is a fantastic opportunity to join Hiscox during a time of focused growth where you will have the remit to make a real difference. At Hiscox we care about our people. We hire the best people for the job and we’re committed to diversity and creating a truly inclusive culture, which we believe drives success.
Location: York; Lisbon; London
Type: Full time
Principal Platform Security Engineer in York employer: Hiscox AG
Hiscox is an exceptional employer, offering a dynamic work environment in the heart of London where innovation and security are at the forefront of our mission. As a Principal Platform Security Engineer, you will not only lead transformative security practices but also benefit from a culture that prioritises diversity, inclusion, and continuous professional growth. With opportunities for mentorship and leadership within a collaborative team, you'll be empowered to make a significant impact while working alongside talented professionals dedicated to excellence.
StudySmarter Expert Advice🤫
We think this is how you could land Principal Platform Security Engineer in York
✨Get Involved in the Cybersecurity Community
Diving into the cybersecurity community is key for landing that full-time gig. Join forums like Reddit's r/cybersecurity or attend local meetups to connect with industry veterans and other job seekers. Networking is everything in this field—don’t just be a passive lurker!
✨Show Off Your Skills with Capture the Flag Competitions
Participate in Capture the Flag (CTF) competitions; these are not just a fun way to boost your skills but also a chance to showcase your talent to potential employers. Many companies, including Hiscox AG, love seeing candidates who actively engage in these challenges.
✨Tailor Your Online Presence
Make sure your LinkedIn and any professional profiles reflect your cybersecurity expertise. Share your projects, whether they’re personal or from a previous role, to catch the eye of hiring managers. This is how they’ll find your passion and commitment to the field!
✨Apply Directly Through Hiscox AG
Don’t forget to head straight to our website and check out any openings for cybersecurity roles at Hiscox AG. Applying directly can sometimes give you an edge, especially if you can mention that you've been following our work or engaging in the community.
We think you need these skills to ace Principal Platform Security Engineer in York
Some tips for your application 🫡
Show off your technical skills:In cybersecurity, it's crucial to highlight your technical prowess. Make sure your CV showcases specific skills like network security, penetration testing, or threat analysis. If you have relevant certifications (like CEH or CISSP), pop those on the front page to grab attention!
Tailor your portfolio for the role:Even for a full-time role, a portfolio can set you apart. If you've worked on any cybersecurity projects—be it CTF challenges, security assessments, or research papers—include these in your application. This demonstrates not just your skills, but also your hands-on experience!
Use real-world examples:When writing your cover letter, don’t just stick to your qualifications. Share real-world examples of how you’ve tackled security issues or vulnerabilities. This gives the hiring team at Hiscox AG insight into your practical problem-solving abilities and makes your application memorable.
Demonstrate your passion for cybersecurity:Cybersecurity is an ever-evolving field, so show us that you’re always learning! Mention any recent courses, webinars, or industry events you’ve attended. This not only exhibits your enthusiasm but also signals to Hiscox AG that you’re committed to staying ahead in the game.
How to prepare for a job interview at Hiscox AG
✨Sharpen Your Technical Skills
For a role in cybersecurity, it’s essential to be up-to-date with the latest tools and techniques. Brush up on your knowledge of firewalls, intrusion detection systems, and vulnerability assessment tools. Be ready to discuss specific scenarios where you’ve applied these skills, as hands-on experience can really set us apart in interviews.
✨Prepare for Scenario-Based Questions
Expect the interviewers at Hiscox AG to throw in some hypothetical situations to see how you’d handle them. Think about common security breaches or incidents and be prepared to explain how you would respond. This not only shows your problem-solving skills but also your understanding of real-world cybersecurity challenges.
✨Highlight Your Certifications
Certifications like CompTIA Security+, CISSP, or CEH can give you a significant edge in a full-time role in cybersecurity. Make sure to mention these during your interview and be prepared to discuss what you learned through those certifications and how they relate to the position at Hiscox AG.
✨Show Your Passion for Cybersecurity
Since you’re going for a full-time gig, showing genuine enthusiasm for the field can make all the difference. Share any personal projects, blogs, or communities you’re part of that relate to cybersecurity. This not only showcases your passion but also your commitment to staying engaged in this ever-evolving field.
