Principal Software Engineer
Principal Software Engineer
Employer Active
Job Alert
You will be updated with latest job alerts via email
Share
Job Alert
You will be updated with latest job alerts via email
Job Description
Job Package
Job Title: Principal Software Engineer - Security Engineer
Job Reference:
Band: BAND D
Salary: 80000-90000k depending on relevant skills knowledge and experience. The expected salary range for this role reflects internal benchmarking and external market insights.
Contract type: Permanent role
Location: This is a hybrid role and the successful candidate will balance office working with home working
Were happy to discuss flexible working. Please indicate your choice under the flexible working question in the application. There is no obligation to raise this at the application stage but if you wish to do so you are welcome to. Flexible working will be part of the discussion at offer stage.
Excellent career progression - the BBC offers great opportunities for employees to seek new challenges and work in different areas of the organisation.
Unrivalled training and development opportunities - our in-house Academy hosts a wide range of internal and external courses and certification.
Benefits - We offer a negotiable salary package a flexible 35-hour working week for work-life balance and 25 days annual leave with the option to buy an extra 5 days a defined pension scheme and discounted dental health care and gym. You can find out more about working at the BBC by selecting this link to our candidate pack.
If you need to discuss adjustments or access requirements for the interview process please contact the . For any general queries please contact: .
Job Introduction
The BBCs digital products reach more than 500 million people every week and are trusted globally as a source of news entertainment and education. That trust is built not only on our editorial standards but also on the security reliability and resilience of the systems behind every stream story and service.
In Engineering Enablement were the team that makes secure high-velocity delivery possible. We build shared cloud platforms developer tooling and guardrails that let hundreds of product teams ship confidently and sustainably.
Were hiring a Principal Software Engineer - Security Engineer to help us embed secure-by-design thinking across the BBC. Youll work hands-on with engineering teams applying InfoSec-led policies and architecture in delivery contexts. Youll support threat modelling promote secure coding practices and help scale Secure SDLC across the organisation - without reinventing governance or duplicating policy.
Its a high-trust role with real impact: translating strategic security direction into pragmatic actionable implementation that helps our teams deliver safely at scale.
Interview process
- Stage 1: Technical Deep Dive (60 mins)
Walk us through your experience delivering secure systems discuss a real-world scenario and complete a short security-focused code or design review. - Stage 2: Collaboration & Influence (60 mins)
Explore how you collaborate with central security teams enable secure engineering at scale and support adoption of policies across delivery teams.
No prep required beyond a few examples of your work.
Main Responsibilities
As a Principal Software Engineer - Security Engineer youll work hands-on with product and platform teams across the BBC to embed secure engineering practices that align with InfoSec direction and policies.
- Drive secure-by-design implementation across infrastructure and applications ensuring delivery aligns with BBC security policy and architectural guidance.
- Promote secure SDLC practices across engineering teams collaborating with InfoSec on shared tooling templates and enablement.
- Help teams adopt secure coding standards and integrate automated security checks (SAST DAST dependency scanning) into CI/CD pipelines.
- Participate in threat modelling using InfoSec-led methodologies and coordinate validation and review workflows.
- Review technical designs proposals and code for alignment with security policies architecture patterns and assurance requirements.
- Act as a bridge between InfoSec and delivery teams - supporting direct collaboration not acting as a gatekeeper.
- Feed real-world engineering insight back into InfoSec governance and assurance forums.
- Champion secure development and operations practices coaching teams and scaling adoption through reusable patterns and guidance.
- Partner with infrastructure teams on security operations needs such as hardening logging and incident readiness.
- Stay ahead of emerging threats and technologies and share relevant insights across the BBC.
Are you the right candidate for the role
We hire for potential and impact. If most of the statements below describe you wed love to hear from you:
- You have a strong track record in software engineering with a focus on application and infrastructure security ideally in agile or DevOps environments.
- Youre fluent in secure development concepts - comfortable with OWASP Top 10 CWE and common secure design patterns.
- Youve helped teams adopt secure SDLC practices working closely with central security or architecture groups.
- You know how to embed tools like SAST DAST secrets detection and dependency scanning into CI/CD pipelines and have the scars to prove it.
- Youve worked with complex multi-tenant cloud platforms - ideally on AWS - and understand shared services infra-as-code and central governance models.
- Youve built secure infrastructure and enforced compliance in the cloud not just designed it on paper.
- You can translate InfoSec policy into pragmatic implementation without reinventing it - and youre trusted by both engineers and architects.
- You collaborate naturally earning trust from delivery teams and central stakeholders alike.
- You communicate clearly and credibly - whether explaining risk trade-offs to a squad or feeding technical insight into an assurance board.
Its a bonus if youve also:
- Facilitated or contributed to threat modelling sessions using frameworks like STRIDE or DFDs.
- Reviewed designs and code with a security lens and an eye for policy alignment.
- Navigated delivery in regulated public service or high-trust environments.
- Been involved in incident response or risk assessment processes.
About the BBC
The BBC is committed to redeploying employees seeking suitable alternative employment within the BBC for different reasons and they will be given priority consideration ahead of other applicants. Priority consideration means for those employees seeking redeployment their application will be considered alongside anyone else at risk of redundancy prior to any individuals being considered who are not at risk.
We dont focus simply on what we do we also care how we do it. Our values and the way we behave are important to us. Please make sure youve read about our values and behaviourshere.
Diversity matters at the BBC. We have a working environment where we value and respect every individuals unique contribution enabling all of our employees to thrive and achieve their full potential.
We want to attract the broadest range of talented people to be part of the BBC whether thats to contribute to our programming or our wide range of non-production roles. The more diverse our workforce the better able we are to respond to and reflect our audiences in all their diversity.
We are committed to equality of opportunity and welcome applications from individuals regardless of age gender ethnicity disability sexual orientation gender identity socio-economic background religion and/or belief. We will consider flexible working requests for all roles unless operational requirements prevent otherwise.
To find out more about Diversity and Inclusion at the BBC please clickhere.
Required Experience:
Staff IC
Employment Type
Full-Time
