Application Security Engineer

Partner with engineering teams to embed security into the software development lifecycle, from design through deployment.

Conduct security code reviews, threat modelling sessions and architecture reviews for flows that move customer funds and identity data.

Select, implement and tune SAST, DAST and SCA solutions to catch vulnerabilities early.

Build and maintain application security testing automation within CI/CD pipelines, with severity-based gating engineering can plan around.

Own the software supply chain, including an SBOM for each deployable service, dependency and provenance standards, and approved base images.

Build and run a consolidated vulnerability register, triaging by real exploitability, assigning owners, and driving remediation to verified closure.

Perform penetration testing and vulnerability assessments of web applications, APIs and mobile applications.

Own the external penetration testing programme, scoping engagements from the threat model and enforcing re-testing.

Develop secure coding standards, reusable security components and role-based training for engineering teams.

Create a security champions programme so security practices scale beyond one person.

Run the bug bounty programme and coordinate with external security researchers.

Research emerging application and supply chain threats and integrate defensive measures into the security architecture.

Evidence secure development and vulnerability management controls for DORA, MiCA, SOC 2 and ISO 27001.

5+ years as a security engineer, with a focus on application or product security.

Deep understanding of web and API security, including the OWASP Top 10, authentication and authorisation, and session management.

Hands-on experience with security testing tools such as Burp Suite, OWASP ZAP, Snyk, and Aikido.

Strong programming skills in a modern language, ideally JavaScript/Node.js or Python.

Experience integrating security tooling into CI/CD pipelines such as GitLab CI, Jenkins or GitHub Actions.

Practical software composition analysis and SBOM experience, with an understanding of modern supply chain attacks against npm and PyPI.

Experience owning vulnerability management, including a register, named owners, enforced SLAs and reported adherence.

Experience applying threat modelling to real business flows and designing secure architecture patterns for APIs and distributed systems.

Solid understanding of cryptography, secrets management and identity and access management.

Excellent communication skills, able to translate security concepts for an engineering audience.

Comfortable building a security capability from nothing rather than inheriting a mature programme.