Application Security Engineer

Responsibilities

• Own application and product security end to end, from design reviews and threat modelling to vulnerability remediation and follow-up.
• Partner with product and platform teams to embed security into the development lifecycle rather than treat it as a final review step.
• Build and improve security controls in CI/CD, including SAST, dependency, secrets, container, and IaC scanning.
• Review application designs and code where security risk is meaningful, and turn recurring findings into secure defaults, shared libraries, lint rules, and CI gates.
• Drive vulnerability management across application code and cloud posture, including triage, risk-based prioritisation, remediation timelines, and external pentest findings.
• Strengthen security in multitenant B2B systems, including tenant isolation, authentication, authorization, RBAC / ABAC, and access controls.
• Work on cloud and Kubernetes security across AWS environments, including IAM, secrets management, network boundaries, and workload hardening.
• Help translate GDPR, SOC 2, and ISO 27001 requirements into practical engineering controls and system properties.
• Develop and support a security champions programme to help engineering teams adopt secure practices in their day-to-day work.
• Address security risks specific to AI and LLM-powered features, including prompt injection, data leakage, and untrusted model output.

Languages