Job Search

We are seeking a Staff Application Security Engineer to provide technical leadership and help strengthen security across the software development lifecycle. You will work closely with engineering, architecture, product and infrastructure teams to embed secure-by-design principles into applications, platforms and delivery processes.

You will lead the identification, assessment and remediation of application security risks, covering design reviews, threat modelling, secure code review, vulnerability management and security testing. You will help define practical security requirements, advise on appropriate controls and support teams in resolving complex issues without unnecessarily slowing delivery.

The role will involve developing and improving application security standards, patterns, tooling and guidance. You will contribute to security automation within CI/CD pipelines, including the effective use of static and dynamic analysis, software composition analysis, secrets detection and infrastructure security checks. You will also help establish meaningful metrics and reporting to track risk, remediation and programme maturity.

As a senior technical contributor, you will act as a trusted adviser and mentor to engineers and security colleagues. You will promote security awareness through documentation, workshops and coaching, while helping to build a consistent, risk-based approach across a varied technology estate. You may also support the investigation of security incidents and the assessment of emerging threats, vulnerabilities and technologies.

You should have substantial experience in application security, software engineering or a closely related discipline, with a strong understanding of modern web applications, APIs, cloud services and secure development practices. Experience with threat modelling methodologies, common vulnerability classes such as OWASP Top 10, security testing tools and automated delivery pipelines is essential.

We are looking for someone who can influence effectively, communicate clearly with both technical and non-technical audiences, and make sound decisions in ambiguous situations. Relevant professional certifications are welcome, but demonstrable practical experience, curiosity and a commitment to continuous improvement are equally valued.