Senior Application Security Engineer - Product Security & DevSecOps

Description

The company builds an enterprise data automation platform that lets firms automate data controls using no-code tools, cloud infrastructure and AI. It handles processing from structured files like Excel and RTF to unstructured ones like PDFs and emails, with the aim of cutting time spent on data work by 90%.

The company is headquartered in London with offices in New York, Wroclaw, Singapore and Antwerp. Its clients include more than 15 of the largest international banks, along with brokers, exchanges, asset managers, hedge funds, administrators, service providers and corporates.

This is a senior role owning application security across the software development lifecycle, from design and code through to the pipelines that ship it. You will work with a small Information Security team based in London and Wroclaw, alongside the Senior Security Engineer (Cloud & SecOps) and the Governance, Risk and Compliance (GRC) function. You will work day to day with Engineering and report to the Head of Information Security.

Responsibilities

• Make secure delivery the default across the SDLC and CI/CD pipelines
• Build and maintain pipeline guardrails: SAST, SCA, secrets scanning, IaC and container image scanning, with gating policies agreed with Engineering
• Strengthen the software supply chain through dependency hygiene, SBOMs and build provenance
• Set pre-deployment cloud guardrails as policy-as-code, working with the Senior Security Engineer (Cloud & SecOps)
• Own Ox Security as the ASPM platform: tune policies, reduce noise and rank findings by reachability and exploitability
• Work with engineering teams to remediate findings, agree remediation SLAs with engineering leads and report progress clearly
• Scope and coordinate application penetration tests and track findings to closure
• Lead threat modelling for new features and major architecture changes
• Run secure design reviews and review high-risk code changes
• Teach secure coding through practical guidance, training and a security champions network across Engineering
• Represent platform security in client security reviews and due diligence, alongside the Head of Information Security
• Maintain application security metrics and KRIs for risk reporting
• Provide evidence of secure development and release practices for audits and client assurance
• Monitor emerging application and supply chain threats, including those affecting AI and agentic capabilities

Requirements

• Proven experience in application security, product security or DevSecOps, ideally in SaaS
• Hands-on experience putting security tooling into CI/CD pipelines
• A record of turning SAST, SCA, secrets or ASPM findings into prioritised fixes, not just reports
• Strong grasp of common vulnerability classes and the OWASP Top 10, with practical remediation skills
• Able to read and review code in at least one of Java, Ruby or Python
• Experience running threat modelling with engineering teams
• Working knowledge of AWS and infrastructure-as-code
• Proficient in Python or a similar scripting language for automation
• Able to influence developers and explain risk in actionable terms
• Desirable: hands-on experience with Ox Security or another ASPM platform
• Desirable: a software engineering background before moving into security
• Desirable: software supply chain security experience, such as SLSA, SBOMs or artefact signing
• Desirable: container and Kubernetes security, including image scanning and admission controls
• Desirable: experience with policy-as-code tooling
• Desirable: experience setting up a security champions programme
• Desirable: experience securing LLM or agentic AI systems, such as applying the OWASP Top 10 for LLM Applications
• Desirable: familiarity with financial services regulation and standards such as DORA, ISO 27001 and SOC 2
• Desirable: professional certifications such as OSWE, GWAPT, CSSLP or AWS Certified Security, Specialty

Conditions

Flexible working policy with 2 days per week in the office

Opportunity to work abroad for up to 6 weeks per year

Unlimited annual holiday

Equal opportunities: applicants are considered without regard to protected characteristics

Benefits

• Competitive salary aligned with skills and experience, reviewed annually
• Annual performance-based bonus
• Healthcare cashback scheme and private medical insurance
• Life assurance at 4X salary
• Enhanced family leave
• 4 volunteering days off
• Employee Assistance Programme
• Cycle to Work and Tech Scheme
• Personal learning and development opportunities
• Referral bonus for hires you recommend
• Spot Rewards
• Employee of the Month and Employee of the Year awards