Principal Software Engineer

Press Tab to Move to Skip to Content Link

Job Title: Principal Software Engineer - Security Engineer

Job Reference:

Band: BAND D

Salary: £80,000-£90,000k depending on relevant skills, knowledge and experience. The expected salary range for this role reflects internal benchmarking and external market insights.

Contract type: Permanent role

Location: This is a hybrid role, and the successful candidate will balance office working with home working

We're happy to discuss flexible working. Please indicate your choice under the flexible working question in the application. There is no obligation to raise this at the application stage but if you wish to do so, you are welcome to. Flexible working will be part of the discussion at offer stage.

Excellent career progression - the BBC offers great opportunities for employees to seek new challenges and work in different areas of the organisation.

Unrivalled training and development opportunities - our in-house Academy hosts a wide range of internal and external courses and certification.

Benefits - We offer a negotiable salary package, a flexible 35-hour working week for work-life balance and 25 days annual leave with the option to buy an extra 5 days, a defined pension scheme and discounted dental, health care and gym. You can find out more about working at the BBC by selecting this link to our candidate pack .

The BBC's digital products reach more than 500 million people every week and are trusted globally as a source of news, entertainment and education. That trust is built not only on our editorial standards, but also on the security, reliability and resilience of the systems behind every stream, story and service.

In Engineering Enablement, we're the team that makes secure, high-velocity delivery possible. We build shared cloud platforms, developer tooling and guardrails that let hundreds of product teams ship confidently and sustainably.

We're hiring a Principal Software Engineer - Security Engineer to help us embed secure-by-design thinking across the BBC. You'll work hands-on with engineering teams, applying InfoSec-led policies and architecture in delivery contexts. You'll support threat modelling, promote secure coding practices, and help scale Secure SDLC across the organisation - without reinventing governance or duplicating policy.

It's a high-trust role with real impact: translating strategic security direction into pragmatic, actionable implementation that helps our teams deliver safely at scale.

• Stage 1: Technical Deep Dive (60 mins)
  Walk us through your experience delivering secure systems, discuss a real-world scenario, and complete a short security-focused code or design review.
• Stage 2: Collaboration & Influence (60 mins)
  Explore how you collaborate with central security teams, enable secure engineering at scale, and support adoption of policies across delivery teams.

No prep required beyond a few examples of your work.

Main Responsibilities As a Principal Software Engineer - Security Engineer, you'll work hands-on with product and platform teams across the BBC to embed secure engineering practices that align with InfoSec direction and policies.

• Drive secure-by-design implementation across infrastructure and applications, ensuring delivery aligns with BBC security policy and architectural guidance.
• Promote secure SDLC practices across engineering teams, collaborating with InfoSec on shared tooling, templates and enablement.
• Help teams adopt secure coding standards and integrate automated security checks (SAST, DAST, dependency scanning) into CI/CD pipelines.
• Participate in threat modelling using InfoSec-led methodologies and coordinate validation and review workflows.
• Review technical designs, proposals and code for alignment with security policies, architecture patterns and assurance requirements.
• Act as a bridge between InfoSec and delivery teams - supporting direct collaboration, not acting as a gatekeeper.
• Feed real-world engineering insight back into InfoSec governance and assurance forums.
• Champion secure development and operations practices, coaching teams and scaling adoption through reusable patterns and guidance.
• Partner with infrastructure teams on security operations needs such as hardening, logging and incident readiness.
• Stay ahead of emerging threats and technologies and share relevant insights across the BBC.

Are you the right candidate for the role? We hire for potential and impact. If most of the statements below describe you, we'd love to hear from you:

• You have a strong track record in software engineering with a focus on application and infrastructure security, ideally in agile or DevOps environments.
• You're fluent in secure development concepts - comfortable with OWASP Top 10, CWE and common secure design patterns.
• You've helped teams adopt secure SDLC practices, working closely with central security or architecture groups.
• You know how to embed tools like SAST, DAST, secrets detection and dependency scanning into CI/CD pipelines, and have the scars to prove it.
• You've worked with complex, multi-tenant cloud platforms - ideally on AWS - and understand shared services, infra-as-code and central governance models.
• You've built secure infrastructure and enforced compliance in the cloud, not just designed it on paper.
• You can translate InfoSec policy into pragmatic implementation without reinventing it - and you're trusted by both engineers and architects.
• You collaborate naturally, earning trust from delivery teams and central stakeholders alike.
• You communicate clearly and credibly - whether explaining risk trade-offs to a squad or feeding technical insight into an assurance board.

It's a bonus if you've also:

• Facilitated or contributed to threat modelling sessions using frameworks like STRIDE or DFDs.
• Reviewed designs and code with a security lens and an eye for policy alignment.
• Navigated delivery in regulated, public service or high-trust environments.
• Been involved in incident response or risk assessment processes.

About the BBC The BBC is committed to redeploying employees seeking suitable alternative employment within the BBC for different reasons and they will be given priority consideration ahead of other applicants. Priority consideration means for those employees seeking redeployment their application will be considered alongside anyone else at risk of redundancy, prior to any individuals being considered who are not at risk.

We don't focus simply on what we do - we also care how we do it. Our values and the way we behave are important to us. Please make sure you've read about our values and behaviourshere .

Diversity matters at the BBC. We have a working environment where we value and respect every individual's unique contribution, enabling all of our employees to thrive and achieve their full potential.

We want to attract the broadest range of talented people to be part of the BBC - whether that's to contribute to our programming or our wide range of non-production roles. The more diverse our workforce, the better able we are to respond to and reflect our audiences in all their diversity.

We are committed to equality of opportunity and welcome applications from individuals, regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion and/or belief. We will consider flexible working requests for all roles, unless operational requirements prevent otherwise.

To find out more about Diversity and Inclusion at the BBC, please clickhere .

Disclaimer This job description is a written statement of the essential characteristics of the job, with its principal accountabilities, incorporating a note of the skills, knowledge and experience required for a satisfactory level of performance. This is not intended to be a complete, detailed account of all aspects of the duties involved.

Please note: If you were to be offered this role, the BBC will conduct Employment screening checks which include Reference checks; Eligibility to work checks; and if applicable to the role, Safeguarding and Adverse media/Social media checks. Any offer made is conditional on these checks being satisfactory.

The BBC is committed to redeploying employees seeking suitable alternative employment within the BBC and they will be given priority consideration ahead of other applicants. Priority consideration means for those employees seeking redeployment their application will be considered alongside anyone else at risk of redundancy, prior to any individuals being considered who are not at risk.

Information at a Glance This is your BBC At the BBC you can create and innovate in an inclusive environment while contributing to some of the world's best loved content, and the BBC's mission to inform, educate and entertain.

Find out more about the BBC Life at BBC Here you will benefit from:

• Fair pay and flexible benefits including a competitive salary package, a flexible 35-hour working week, 25 days annual leave with the option to buy an extra 5 days, a defined pensionscheme and discounted dental, health care and gym.
• Excellent career and professional development.
• Support in your working life, including flexible working which you can discuss with us at any point during the application, selection or offer.
• A values-based organisation where the way we do things is important as what we do click apply for full job details