Application Security Engineer (f/m/d)

About the role

<p><strong>Purpose of Position</strong></p> <p>Your role is to establish and lead an AppSec program within the Product and Technology department, acting as an evangelist for AppSec, trusted by engineers and managers alike.</p> <p>As a member of the core security team, you will engage in assessing application design proposals, to identify improvements to enable our engineers to create secure products.</p> <p>You will own the existing training program, redesign it to better equip engineers with the knowledge needed to develop secure applications, and create a Security Champions program to scale and embed a DevSecOps mindset across P&amp;T. &nbsp;</p> <p>&nbsp;</p> <p><strong>What you'll be responsible for</strong></p> <ul> <li><strong>Secure the SDLC</strong>: Integrate security tooling (e.g. SAST, DAST, dependency scanning) into CI/CD pipelines and IDEs. Automate and optimise checks so teams can identify and fix issues early and efficiently.</li> <li><strong>Threat modelling &amp; secure design</strong>: Collaborate with product and engineering teams during the design phase to conduct threat modelling sessions and pre-implementation security reviews.</li> <li><strong>Code &amp; architecture reviews</strong>: Guide developers on secure coding practices, perform targeted code reviews, and help resolve vulnerabilities with actionable remediation support.</li> <li><strong>Vulnerability lifecycle management</strong>: <ul> <li>Identify, triage, track and report on vulnerabilities across internal and external apps and systems.</li> <li>Collaborate with engineers to close gaps efficiently.</li> <li>Support the bug bounty process with finding validation.</li> <li>Present vulnerability management reports to our heads of department.</li> </ul> </li> <li><strong>AI/ML &amp; LLM security</strong>: <ul> <li>Provide guidance on secure development of AI/LLM-powered features.</li> <li>Help teams manage risks such as prompt injection, model misuse, and data leakage.</li> <li>Lead threat modelling exercises for AI components and advise on secure integration patterns.</li> </ul> </li> <li><strong>Incident response collaboration</strong>: Support investigation and root cause analysis of application-layer incidents. Contribute to post-incident reviews and longer-term mitigation strategies.</li> <li><strong>Security culture &amp; enablement</strong>: <ul> <li>Act as a security champion for development teams.</li> <li>Be an enthusiastic and vocal advocate for application security across all engineering and product teams.</li> <li>Nurture and report on our application security training program for our code contributors.</li> <li>Deliver workshops and technical deep-dives on secure development practices.</li> <li>Contribute to playbooks, documentation, and internal standards.</li> </ul> </li> <li><strong>Research &amp; innovation</strong>: <ul> <li>Stay ahead of industry threats and attack trends. Propose and test innovative ideas to reduce risk across our software supply chain and platforms.</li> <li>Showcase how to use AI and AI-powered tools to enhance productivity and improve our security posture.</li> </ul> </li> </ul> <p>&nbsp;</p> <p><strong>Your skills</strong></p> <ul> <li>5+ years in application security, product security or related technical roles.</li> <li>Experience working directly with software engineer and product managers to secure web applications.</li> <li>Experience in working within an Agile environment.</li> <li>Good working proficiency in spoken and written English.</li> <li>Excellent interpersonal skills and ability to clearly communicate at every level of the organisation.</li> <li>Mentorship and training skills.</li> <li>Ability to work across two different departments with multiple touch points.</li> <li>Coding proficiency in languages such as JS, PHP, Python.</li> <li>Experience with Cloud Native environments (AWS), Containers and Terraform.</li> <li>Hands on experience with DAST, SAST, SCA tools, reporting and dashboarding p

Skills