Senior Application Security Engineer

• We’re looking for a Senior Application Security Engineer to join our expanding Information Security team
• You will join a modern, cloud‑native environment where squads genuinely care about secure engineering, and you will have the autonomy, tooling and influence to help them excel
• You will work alongside our existing Senior AppSec Engineer and Security Architect, strengthening our capacity and resilience as we continue to mature our security services. This is not a vulnerability management position. It is true engineering‑led AppSec, shaping secure design, embedding controls into CI/CD, operating core security services and getting into the technical detail of how our systems are built
• You will help define how we secure applications across Azure, AKS, Databricks, Snowflake and more, with the freedom to influence processes, tooling and engineering culture
• Partnering with development teams across architecture, engineering and cloud to embed security into code, applications, Kubernetes and containerised workloads
• Encouraging a shift‑left approach and promoting secure engineering practices
• Implementing and operating code scanning to help developers identify and remediate vulnerabilities
• Maturing our Secure Development Lifecycle, embedding security into CI/CD in GitHub Actions and strengthening development tooling
• Advising on securing APIs and other high‑risk system components
• Assisting with securing our Data Platforms including Databricks, Dagster, Snowflake and the wider cloud environment
• Developing security policy as code using OPA or similar and gaining adoption across teams
• Documenting security processes and low‑level designs for security tools and services
• Contributing to security service documentation to support consistent delivery and operations
• Assisting teams integrating with security tooling and ensuring smooth onboarding to security services
• Supporting wider security initiatives including ISO 27001 activities and threat modelling

Benefits

• 30 days annual leave plus bank holidays.
• Generous company pension package with employer contributions of up to 12%
• We have a lovely new office in Holborn, Central London and we offer flexible and remote working arrangements.
• We offer all employees a life assurance policy.
• Training support to help you achieve your potential.
• All employees are covered by a group income protection scheme to support them in the event of long term sickness.

• If you are a hands‑on AppSec expert who enjoys working deep in the SDLC, partnering with talented engineers and building security into fast‑moving delivery pipelines, this role gives you the space to make a real impact
• If you come from a startup or scale‑up background, thrive in cloud‑native environments and enjoy being the trusted expert for squads who want to do the right thing, you will feel at home here
• Proficient in writing Terraform, Python and ideally KQL
• Experience working directly with software engineering best practices including source control, unit testing, code reviews, design documentation and strong debugging and troubleshooting
• Knowledge of ISO 27001 and its relevance to secure engineering
• Experience of securing Kubernetes ideally AKS, along with broader container security
• Relevant certifications such as Microsoft MS‑500, AZ‑500, AZ‑700, SC‑200, CompTIA Security+ or Cloud+, CSA CCSK, ISC2 CSSLP, GIAC GWAPT or EC‑Council CASE
• Experience of automating security capabilities and delivering security or policy as code using tools such as OPA or Azure Policy
• Experience in threat modelling within engineering teams
• Desire to be part of a small fast‑paced team with a collaborative mindset
• Experience of securing GitHub and GitHub Actions, or similar CI/CD platforms
• Ideally experience in securing data platforms such as Databricks, Dagster or Snowflake
• Exposure to Agile working and DevSecOps
• Experience of securing APIs and other exposed components
• Significant hands‑on experience with implementing and operating code scanners including SAST, DAST, IAST and SCA