About the Role
We're looking for a Senior Application Security Engineer to join our expanding Information Security team. If you are a hands-on AppSec expert who enjoys working deep in the SDLC, partnering with talented engineers and building security into fast-moving delivery pipelines, this role gives you the space to make a real impact. You will join a modern, cloud-native environment where squads genuinely care about secure engineering, and you will have the autonomy, tooling and influence to help them excel.
Responsibilities
•Partnering with development teams across architecture, engineering and cloud to embed security into code, applications, Kubernetes and containerised workloads
•Encouraging a shift-left approach and promoting secure engineering practices
•Implementing and operating code scanning to help developers identify and remediate vulnerabilities
•Maturing our Secure Development Lifecycle, embedding security into CI/CD in GitHub Actions and strengthening development tooling
•Advising on securing APIs and other high-risk system components
•Assisting with securing our Data Platforms including Databricks, Dagster, Snowflake and the wider cloud environment
•Developing security policy as code using OPA or similar and gaining adoption across teams
•Documenting security processes and low-level designs for security tools and services
•Contributing to security service documentation to support consistent delivery and operations
•Assisting teams integrating with security tooling and ensuring smooth onboarding to security services
•Supporting wider security initiatives including ISO 27001 activities and threat modelling
Requirements
•Proficient in writing Terraform, Python and ideally KQL
•Significant hands-on experience with implementing and operating code scanners including SAST, DAST, IAST and SCA
•Experience of automating security capabilities and delivering security or policy as code using tools such as OPA or Azure Policy
•Experience of securing GitHub and GitHub Actions, or similar CI/CD platforms
•Experience of securing Kubernetes ideally AKS, along with broader container security
•Experience of securing APIs and other exposed components
•Experience working directly with software engineering best practices including source control, unit testing, code reviews, design documentation and strong debugging and troubleshooting
•Experience in threat modelling within engineering teams
•Exposure to Agile working and DevSecOps
•Knowledge of ISO 27001 and its relevance to secure engineering
•Desire to be part of a small fast-paced team with a collaborative mindset
•Relevant certifications such as Microsoft MS-500, AZ-500, AZ-700, SC-200, CompTIA Security+ or Cloud+, CSA CCSK, ISC2 CSSLP, GIAC GWAPT or EC-Council CASE
Nice to Have
•Ideally experience in securing data platforms such as Databricks, Dagster or Snowflake
Benefits
•Salary from £70,000 per annum
•Generous Pension Scheme - employer contributions of up to 12%
•30 Days Holiday + Bank Holidays, with flexibility to take bank holidays when it suits you
•Enhanced Parental Leave
•Cycle to Work Scheme - save 25-39% on a new bike and accessories through salary sacrifice
•Home & Tech Savings - up to 8% off on IKEA and Currys products, spread over 12 months through salary sacrifice
•£1,000 Employee Referral Bonus
•Wellbeing Support - Mental Health First Aiders, 24/7 online GP services and an Employee Assistance Programme for you and your family
•A lovely Central London office in Holborn, with flexible and remote working arrangements
