Application Security Engineer

Application Security Engineer – Manchester Based (3 Days Hybrid)

Finova is seeking a hands‑on Application Security Engineer to embed security into the design, build, and shipment of software across a multi‑cloud SaaS fintech platform.

• Core Responsibility: Partner closely with developers, the IAM Specialist, and the Cloud Security Engineer to ensure identity, infrastructure, and code are defended together.
• The Stack: Multi‑cloud environment spanning AWS, Azure and GCP. Applications run on .NET / ASP.NET with SQL Server backends.
• Key Challenge: Protect regulated financial data while defending a growing portfolio of AI‑powered features against a new class of application risks (prompt injection, model abuse, and training data leakage).
• Work Model: Highly collaborative, hands‑on hybrid role focused on making secure‑by‑default the path of least resistance for engineering teams.

• Experience: 4–6 years in application security, product security, or security‑focused software engineering within regulated environments.
• Framework Expertise: Strong working knowledge of .NET / ASP.NET application security (Claims‑based identity, ASP.NET Core authorization, data protection APIs).
• Security Models: Deep familiarity with OWASP Top 10, OWASP ASVS, and hands‑on experience leading threat modelling sessions (STRIDE/attack trees).
• CI/CD Pipeline
  
  Skills:
  
  Experience integrating and tuning security tools (SAST, SCA, DAST) within Azure Dev Ops, Git Hub Actions or similar pipelines.
• Code Review: Confident reading and reviewing C# code to find authorization flaws, deserialization issues, or tenant isolation gaps during PRs.
• Core Fundamentals: Solid understanding of cryptographic primitives, API security at scale (OAuth 2.0 / OIDC, JWT pitfalls), and SaaS multi‑tenancy data exposure risks.
• Consultative Delivery: Experience working as a delivery engineer or consultant, shipping security work into messy, deadline‑driven customer environments.
• Communication: Clear communicator who can effectively coach a junior engineer, debate with a senior engineer, and explain critical risks to non‑technical executives.

• Fintech Background: Experience working in fintech, payments, banking or insurance environments.
• AI Security: Hands‑on experience securing AI/LLM features, prompt injection defense, and familiarity with OWASP LLM Top 10 or MITRE ATLAS.
• Offensive Security: An offensive security background (OSCP, OSWE or equivalent) or experience with bug bounty program design.
• Certifications: CSSLP, GWAPT, GWEB, CISSP or vendor‑specific cloud security certifications.
• Database Security: Experience identifying SQL Server‑specific application risks, including ORM misuse and stored procedure vulnerabilities.
• Community Contributions: Contributions to open‑source security tooling, CVE research, or published security writing.

• The Collaborative Builder: Thrive in shared‑accountability environments, working alongside infrastructure and identity specialists to build multi‑layered defenses.
• Pragmatic and Ruthless: Tune tools to protect developer workflows from noise, ensuring that every alert is a high‑signal, high‑trust finding.
• Curious and Adaptive: Energized by new technical frontiers, translating the emerging risks of AI endpoints and LLMs into practical engineering guardrails.
• Resilient Communicator: Comfortable operating in regulated environments, translating complex vulnerabilities into business context for leadership while remaining a trusted peer to developers.

• Toolchain Ownership: Own the application security toolchain end‑to‑end (SAST, SCA, DAST, secrets, container and IaC scanning) integrated into Azure Dev Ops and Git Hub Actions.
• Scanner Optimization: Tune scanners to maximize high‑signal findings and eliminate noise so engineers trust the alerts.
• Early Detection: Build and maintain pre‑commit and pull‑request security checks to catch issues before code is merged.
• Vulnerability Management: Drive CVSS‑based SLAs, automated tracking and exception workflows for application‑layer issues across product teams.
• Coding Standards: Define and evolve secure coding…