Senior Application Security Engineer

Location: UK (fully remote)

IR35 Status: Inside IR35

Start Date: ASAP

We are recruiting for an experienced Senior Application Security Engineer to support a major UK health research programme focused on transforming the prevention, detection and treatment of serious diseases.

This is an opportunity to work on a large-scale digital platform supporting pioneering health research, where the security of sensitive health and genetic information is critical.

You'll join an established security function, working closely with software engineers, Dev Ops teams and security architects to design, implement and maintain robust application security controls.

This is a genuinely hands‑on engineering position, not a general Cloud Security, Dev Sec Ops  or security governance role.

• Implement and maintain SAST, DAST and SCA security tooling within CI/CD pipelines.
• Embed automated security scanning, quality gates and vulnerability detection into software delivery workflows.
• Work directly with developers to identify, investigate and remediate application security vulnerabilities.
• Strengthen Secure Software Development Lifecycle (SSDLC) practices across engineering teams.
• Conduct application threat modelling, secure code reviews and API security assessments.
• Develop security automation using Python, Terraform and other relevant technologies.
• Implement security controls across Azure, Kubernetes and AKS environments.
• Support policy-as-code implementation and automated security enforcement.
• Improve application security tooling, processes and developer adoption.
• Strong commercial experience in a dedicated Application Security Engineering role.
• Proven hands‑on implementation of SAST, DAST and SCA tooling.
• Experience integrating security controls into CI/CD pipelines, ideally Git Hub Actions.
• Strong understanding of secure coding practices, OWASP Top 10 and application threat modelling.
• Practical experience securing APIs and modern cloud-native applications.
• Experience working directly with software engineering teams on vulnerability remediation.
• Ability to independently configure security tooling, troubleshoot integrations and implement technical security improvements.
• Python scripting and security automation.
• Terraform and Infrastructure as Code.
• Kubernetes, AKS and container security.
• Databricks, Snowflake or Dagster.
• ISO 27001 knowledge.

We're looking for someone who enjoys getting hands‑on with technology and solving complex application security challenges.

You'll be comfortable working directly within engineering environments, configuring security tools, writing automation and implementing security controls that improve software security without unnecessarily slowing development.

You'll bring strong technical expertise, a collaborative approach and the ability to deliver practical security improvements from day one.