Application Security Engineer

Overview

In this role you will own security across a large, AI-enabled data platform handling sensitive genomic data. You will lead threat modelling and secure design with product teams, and build patterns and tooling to make secure coding the default. You’ll drive vulnerability discovery and remediation, leveraging AI-assisted security tooling and expert judgement. You’ll collaborate cross-functionally to defend multi-tenant systems in the cloud and help shape secure product delivery.

Pay / Benefits

• 25 days annual leave + bank holidays + 3-day year-end shutdown
• market-leading pension scheme
• private health insurance for you and family (no excess)
• enhanced paid family leave
• hybrid working
• cycle-to-work scheme

Responsibilities

• Lead threat modelling and design reviews for new products and infrastructure, establishing security invariants like tenant isolation and least privilege
• Develop libraries, patterns, and CI/CD guardrails to promote secure practices
• Build and tune AI-assisted code analysis tooling and set trust boundaries for its outputs
• Identify and remediate vulnerabilities through code review, testing, and PoC exploits, overseeing disclosure and fixes
• Secure AI surfaces and prompt/tool boundaries, ensuring resistance to adversarial testing
• Collaborate with product teams, SRE, detection and response, and ML teams to unblock work without gating
• Act as embedded security partner to drive risk-aware decisions and mentor teams

Key requirements

• Production experience in application security
• Proficient in at least one mainstream language (Python, Go, or TypeScript) and ability to read others
• Experience building or operating security/developer tooling in CI/CD (static analysis, secrets detection, policy-as-code)
• Hands-on security for multi-tenant cloud environments (AWS; RDS, EC2, S3, EKS, Batch) and knowledge of IAM, least privilege, and secrets management
• Familiarity with AI/LLM tooling for security tasks and understanding their limitations
• Experience with vulnerability disclosure programs and remediation lifecycle (severity, SLAs, root cause)
• Strong risk-based judgment and ability to communicate risk and trade-offs to engineers and leadership
• Excellent written and verbal communication and mentoring ability

• Clear communication
• Collaborative mindset
• Strong analytical and risk assessment skills
• Python
• Go
• TypeScript

…