Senior Application Security Engineer

Overview

In this role you will embed application security into the SDLC for a health research charity, partnering with engineering, architecture and cloud teams. You will implement secure design and testing, and help development squads build secure apps. The role focuses on implementing security controls in CI/CD and strengthening governance across Azure and containerized environments. You will drive automation, policy-as-code and threat modelling to protect cloud-hosted data and APIs. This is a hands-on position with a clear impact on secure software delivery at scale.

Pay / Benefits

• Salary up to 80,000 DOE
• Remote / hybrid working
• London office
• Full-time permanent position
• Benefits package

Responsibilities

• Promote secure development with engineering and architecture teams
• Implement and maintain application security testing solutions
• Integrate security controls into CI/CD pipelines
• Strengthen security of GitHub Actions and similar CI/CD tools
• Provide guidance on secure API design and externally accessible systems
• Support Azure cloud infrastructure and AKS
• Develop security-as-code and policy-as-code
• Support security of cloud-hosted data platforms
• Automate security processes via infrastructure-as-code and scripting
• Maintain technical and security documentation
• Support development teams with security tooling and best practices
• Contribute to threat modelling and compliance activities

Key requirements

• Hands-on experience embedding application security into the SDLC
• Azure security controls and cloud security governance experience
• KQL experience
• Experience securing APIs, internet-facing services, Kubernetes/AKS and containerised environments
• Experience with SAST, DAST, IAST and SCA
• Security automation and policy-as-code knowledge
• Familiarity with GitHub and GitHub Actions
• Terraform and Python experience
• Understanding of cloud security governance
• Experience with threat modelling in software engineering contexts
• Knowledge of ISO 27001 relevance to secure engineering
• Agile/DevSecOps exposure

• collaboration with cross-functional teams
• clear communication
• problem-solving
• Microsoft Azure
• Azure Kubernetes Service (AKS)
• KQL

…