Application Security Engineer

Help Build Security into Products That Matter

We're looking for an experienced Application Security Engineer to join our Security Engineering team on a 12-month fixed-term contract.

This isn't a role where security sits on the side-lines. You'll be Embedded in product delivery, working directly with engineers, architects and product teams to ensure security is considered from the earliest design conversations through to deployment and beyond. You'll combine technical expertise with practical problem-solving, helping teams build secure solutions without slowing innovation.

If you enjoy collaborating with developers, influencing technical decisions, and turning security challenges into workable solutions, we'd love to hear from you.

As the dedicated Application Security Engineer for a portfolio of customer-facing and digital products, you'll be trusted to:

• Partner with product and engineering teams to understand systems, data flows, users and business priorities.
• Review solution designs and facilitate threat modelling workshops, helping teams identify risks before they become problems.
• Provide practical, real-world guidance on secure architecture and development across applications, APIs, cloud services and integrations.
• Help teams embed security into their development pipelines through automation, tooling and security-by-design practices.
• Investigate, triage and prioritise vulnerabilities, translating technical findings into clear actions for development teams.
• Coordinate penetration testing activities and support teams through remediation and re-testing.
• Assess the security of SaaS platforms, third-party technologies and external integrations.
• Work closely with Security Operations, Identity & Access Management and Cloud Security colleagues where risks cross functional boundaries.
• Represent security interests within technical governance forums, providing balanced advice and escalating significant risks when required.
• Contribute to evolving security standards, secure development practices and application security maturity across the organisation.
• Maintain clear records of decisions, risks and recommendations, ensuring a smooth handover at the end of the contract.

You're someone who enjoys solving problems, building relationships and making security relevant and actionable.

You understand that the best security professionals don't just identify risks, they help teams address them in practical ways.

You'll have experience across areas such as:

• Secure by Design principles
• Threat modelling
• Application security testing
• Vulnerability management
• Security risk assessment
• Secure software development practices

Experience with technologies such as Java/Spring Boot, React, Node.js, Snowflake, Salesforce, Kubernetes/Open Shift, Snyk or Wiz would be beneficial, but we're equally interested in candidates who have gained relevant experience across different technology stacks and tooling.

You’ll likely have:

• Experience working in Application Security, Product Security or Secure Software Engineering.
• A strong understanding of common application and API security risks, including authentication, authorisation, data protection and security misconfiguration.
• Experience reviewing architectures and facilitating threat modelling workshops using STRIDE or similar methodologies.
• Hands-on experience with security testing practices and tools, including SAST, software composition analysis, secrets detection, API security testing and infrastructure or container scanning.
• The ability to assess vulnerabilities through both a technical and business lens, helping teams focus on what matters most.
• Familiarity with modern engineering…