Security Software Engineer

The BBC is looking for a Security Software Engineer to join its BBC MediaTech DevOps group in London. This is a permanent, full-time on-site role, with a salary up to £57,500 per year depending on relevant skills and experience. Flexible working is on the table to discuss at offer stage, with the team open to considering workable arrangements as part of the process. BBC MediaTech is a key part of the broadcaster’s technology and product work, and the role sits in a team focused on secure software delivery across media technology platforms.

You’ll be working on practical engineering challenges alongside seasoned engineers, helping to design, build, operate and improve the software, platforms and automation that support secure software delivery. The role blends software engineering, cloud infrastructure, security tooling, CI/CD, vulnerability management and automation, with an emphasis on broad exposure to different parts of DevSecOps rather than carving out a single specialty.

If you enjoy tackling hands-on problems and delivering well-scoped pieces of work while collaborating with senior engineers on larger changes, this could be a good fit. The BBC emphasizes independent delivery within the DevSecOps context and values engineers who can contribute across security engineering, tooling and automation rather than staying focused on one platform alone.

Mornings in the DevSecOps lab

Your days revolve around building integrations that connect security, engineering and organisational data so teams can understand and act on findings quickly. You’ll maintain and improve backend services, integrations, automation and internal tools, all while working with AWS infrastructure and Infrastructure as Code to deliver secure cloud-based services. Security checks will be threaded into CI/CD workflows, including dependency and code scanning, secrets detection and container or infrastructure security tooling, and you’ll apply secure engineering practices around identity and access management, secrets, logging, monitoring, data handling and least-privilege access. You’ll help operate and improve the security and vulnerability-management platforms used by engineering teams, investigate issues across services and tooling, and write automated tests, documentation and operational tooling to keep production services reliable. Expect to deliver defined engineering changes from start to finish, sometimes solo and sometimes with guidance from senior engineers, and to work with other teams to translate security or operational problems into practical, reusable solutions and automation. You’ll also explore how AI-assisted engineering tools can support coding, testing, investigation, automation or security analysis when they’re helpful to the work.

What the BBC is looking for in this role

Must-have essentials

• Experience building and operating software services, automation or tooling, using at least one modern programming language.
• Familiarity with cloud infrastructure (AWS preferred), IaC practices, automated software delivery and CI/CD workflows.
• Solid understanding of secure engineering principles, including APIs, identity and access management, secrets handling, monitoring and software security best practices.
• Strong problem-solving ability and technical ownership, with a track record of investigating unfamiliar systems and delivering practical fixes with limited day-to-day supervision.
• Collaborative engineering experience, including use of source control and automated tests, and the ability to explain technical challenges and decisions clearly within a team, with an interest in DevSecOps and security engineering.

Nice-to-haves

• Experience with vulnerability management, application and cloud security tooling, including dependency scanning, static analysis, secrets detection or container security tooling.
• Hands-on work with modern cloud architectures such as serverless, containers, event-driven designs or microservices.
• Experience building integrations using APIs, webhooks and event-driven technologies.
• Strong operational discipline around logging, monitoring, alerting and incident investigation.
• Contributions to shared engineering platforms or tooling, including the use of AI-assisted development tools to improve engineering productivity.

If you can bring some of these skills and experiences, along with transferable strengths, the BBC would like to hear from you and encourages you to apply.

Compensation and how you’ll work

The role carries a salary of up to £57,500 per year, dependent on relevant skills, knowledge and experience.

The position is based in London and on-site, with the option to discuss flexible working arrangements at offer stage.

In short, this is a chance to contribute to secure software delivery across BBC MediaTech, using a mix of software engineering, cloud infrastructure, security tooling and automation, all within a team that values practical problem solving and collaboration.

How to position yourself for this BBC post

Start your resume with hands-on DevSecOps work that shows you’ve built and operated software services, automated workflows or engineering tooling. If you have cloud experience, highlight AWS-related projects, IaC use and end-to-end software delivery pipelines. Demonstrate how you’ve implemented secure practices across identity, secrets management, logging and monitoring, and how you’ve contributed to security tooling or vulnerability management in real-world settings.

When you describe your must-have capabilities, include concrete examples of building integrations that linked security data with engineering workflows, and show how you’ve integrated security checks into CI/CD. In interviews, be ready to walk through incidents or issues you’ve investigated across services, cloud infrastructure or security platforms and explain the fixes you delivered, along with any automated tests or tooling you created to prevent repeats. Consider preparing a short demonstration or overview of a past project that shows end-to-end delivery from design to deployment and the security controls you put in place.

A smart question to ask: how does the team currently leverage AI-assisted development tools in coding, testing or security analysis, and how are security tooling and governance integrated into the BBC’s CI/CD pipelines?