Principal Security Engineer

Principal Security Engineer London (Hybrid) | Technology & Engineering | Permanent The Role

As a Principal Security Engineer at Capco, you'll lead hands-on security engineering delivery for clients across financial services and other complex environments. Depending on the engagement, you'll lead a technical workstream or operate independently as a Principal specialist. Your focus will span Application & Product Security, Cloud & Platform Security and DevSecOps, underpinned by strong security automation. You'll combine specialist depth with cross-domain judgement, client engagement and secure-by-design engineering.

What You'll Do

• Lead the design, implementation and technical assurance of secure solutions across applications, cloud platforms and delivery pipelines; remain hands-on with complex engineering and integration challenges.
• Work directly with clients to understand requirements, lead technical workshops and shape practical security designs, delivery plans and technical proposals.
• Embed security-by-design across applications, APIs, cloud workloads and the secure SDLC through threat modelling, CI/CD controls, SAST, SCA, DAST and container scanning.
• Build and integrate scalable security automation using scripting, APIs, Infrastructure as Code and policy as code; improve control effectiveness and engineering workflows.
• Lead technical workstreams or specialist assignments, assure engineering quality and operational handover, mentor engineers and develop reusable standards and patterns.
• Leverage approved AI-enabled tools and automation to enhance security engineering efficiency and effectiveness, ensuring appropriate human oversight, security guardrails and validation.

What We're Looking For

• Proven hands-on security engineering delivery and technical leadership, including secure design decisions, engineering assurance, client engagement and mentoring.
• Deep implementation expertise in one or more of Application & Product Security, Cloud & Platform Security or DevSecOps, with working knowledge of the other areas.
• Practical experience securing applications, APIs, cloud workloads or engineering pipelines, supported by sound knowledge of threat modelling, vulnerability management and secure SDLC practices.
• Experience with at least one major cloud platform (Azure, AWS or GCP) and cloud-native security principles, including an understanding of IaC, containers and workload identities.

<li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":706,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777