Application Security Engineer

Important notice to applicants Genomics is aware of an individual falsely presenting themselves as a representative of Genomics and attempting to recruit candidates on our behalf. Please be vigilant when responding to recruitment approaches. Genuine communications from Genomics will come from an email address ending in  Emails or other communications relating to recruitment that come from individuals or organisations using a different email domain may not be genuine.

If you receive a recruitment communication and you are unsure, please do not provide personal information. Instead, please reach out to us directly via our form on the Contact Us page.

The growth of Genomics is partnered with the personal growth of our people. We ensure that all employees have the tools, technologies, benefits, and support systems to develop and flourish. We offer a competitive package of benefits, training opportunities, and initiatives to ensure our employees thrive.

Our workforce operates across the UK and US from offices based in Oxford, UK, London, UK Cambridge, UK, and North Carolina, US. Our diversity and multinationalism, with our people hailing from over 30 countries, helps to bring together the best minds to harness the power of genomics and transform healthcare and drug discovery.

Life insurance

Charities trust

Pension

Group income protection

Cycle to work scheme

Critical illness cover

Private medical cover

Bank your Bank Holidays

Social events

Training and development opportunities

Organised sports activities

London;
Oxford

Hybrid

Location: Oxford or London (Hybrid)

Genomics is a science-led transatlantic Tech Bio combining large-scale genetic and health data with proprietary analytics to accelerate drug discovery and advance predictive, preventative healthcare. We are united by a single vision to help people live longer, healthier lives, using the power of genomics.

Genomics aims to help people live longer, healthier lives in two ways: super-charging drug discovery and development for novel treatments with our AI-enabled advanced genetic analytics platform, and by helping people understand their personal risk of common chronic diseases through polygenic risk scores - giving doctors and health systems the chance to get the right people into the right prevention, screening and treatment programmes at the right time.

Genomic data is some of the most sensitive data there is, and our customers trust us with it. As Senior Application Security Engineer on Mystra, you'll own application security end-to-end across multi-tenant, trillion-row-scale, AI-enabled data platforms.

You'll lead threat modelling and design review with product teams, build the tooling and patterns that make secure codet, and find and fix the vulnerabilities that slip through. You'll do it with security-focused AI tooling, steered by your own expert judgement and intuition, to keep Genomics secure against state-of-the-art threats.

Leading threat modelling and design reviews for new products and infrastructure, and defining the security in variants every team builds against: tenant isolation, authentication and authorisation, secrets, least privilege, and trust boundaries

Building the libraries, patterns, and CI/CD guardrails that make the secure way the easy way, and deciding what is enforced versus advised

Building and tuning AI tooling for code analysis, triage, and remediation, and deciding where its output can be trusted and where it must be verified

Hunting for vulnerabilities through code review, testing, and proof-of-concept exploits, then running the disclosure programme and driving every finding through to a verified fix

Securing our agentic and AI surfaces, from prompt injection and tool boundaries to delegated credentials and tenant-scoped access, and proving the controls hold under adversarial testing

Working as an embedded, trusted partner to product teams, SRE, detection and response, the data platform team, and the MystraAI / ML team, unblocking rather than gating

Experience with in application security in production. You've found and fixed exploitable bugs in software you were responsible for, through threat modelling, secure design, code review, and proof-of-concept exploitation across web services, APIs, and data-serving interfaces. Triaging…