Senior Application Security Engineer - Product Security & DevSecOps

Description

The company builds an enterprise data automation platform that lets firms automate data controls using no-code tools, cloud infrastructure and AI.

The platform handles data end to end, from structured spreadsheets and RTF files to unstructured PDFs and emails, with the aim of cutting time spent on data work by 90%.

Clients include more than 15 of the world's largest international banks, along with brokers, exchanges, asset managers, hedge funds, administrators, service providers and corporates.

The company is headquartered in London, with offices in New York, Wrocław, Singapore and Antwerp.

This role owns application security across the software development lifecycle, making secure delivery the norm for engineering from design and code through to release pipelines.

You will join a small, collaborative Information Security team in London and Wrocław, working with the Senior Security Engineer (Cloud & SecOps) and the Governance, Risk and Compliance function. You report to the Head of Information Security and work day to day with Engineering.

Responsibilities

• Own security across the software development lifecycle and CI/CD pipelines, so secure delivery is the standard for every engineering team.
• Build and run pipeline guardrails covering SAST, SCA, secrets scanning, and IaC and container image scanning, with gating policies agreed with Engineering.
• Improve software supply chain security through dependency hygiene, SBOMs and build provenance.
• Set pre-deployment cloud guardrails as policy-as-code, working with the Senior Security Engineer (Cloud & SecOps).
• Run the ASPM platform: tune policies, cut noise, and rank findings by reachability and exploitability.
• Drive fixes with engineering, agree remediation SLAs with engineering leads, and report progress clearly.
• Scope and coordinate application penetration tests, following findings until they are fixed.
• Lead threat modelling for new features and major architectural changes.
• Carry out secure design reviews and review high-risk code changes.
• Support secure coding through practical guidance, training and a security champions network across Engineering.
• Represent platform security in client security reviews and due diligence, alongside the Head of Information Security.
• Maintain application security metrics for risk reporting and key risk indicators (KRIs).
• Provide evidence of secure development and release practices for audits and client assurance.
• Track emerging application and supply chain threats, including those affecting AI and agentic capabilities.

Requirements

• Proven background in application security, product security or DevSecOps, ideally in a SaaS setting.
• Hands-on experience building security tools into CI/CD pipelines.
• A record of turning SAST, SCA, secrets or ASPM results into prioritised fixes, not just reports.
• Strong grasp of common vulnerability classes and the OWASP Top 10, with practical remediation skills.
• Able to read and review code in at least one of Java, Ruby or Python.
• Experience running threat modelling sessions with engineers.
• Working knowledge of AWS and infrastructure as code.
• Proficiency in Python or a similar scripting language for automation.
• Credible with developers: you influence engineering teams and explain risk in practical terms.
• Desirable: hands-on use of the ASPM platform used here or another ASPM tool.
• Desirable: a background in software engineering before moving into security.
• Desirable: software supply chain security work, such as SLSA, SBOMs or artefact signing.
• Desirable: container and Kubernetes security, including image scanning and admission controls.
• Desirable: experience with policy-as-code tools.
• Desirable: experience setting up a security champions programme.
• Desirable: experience securing LLM or agentic AI systems, for example against the OWASP Top 10 for LLM Applications.
• Desirable: familiarity with financial services regulations and standards such as DORA, ISO 27001 and SOC 2.
• Desirable: relevant professional certifications such as OSWE, GWAPT, CSSLP or AWS Certified Security Specialty.

Conditions

Hybrid working, with 2 days in the office.

Team based across London and Wrocław.

Reports to the Head of Information Security.

Benefits

• Competitive salary, matched to your skills and experience and reviewed annually.
• Success Share bonus payments.
• Referral bonus if you recommend someone we hire.
• Spot Rewards.
• Private medical insurance through Enel Med.
• Life insurance.
• Multisport programme.
• Unlimited annual holiday, based on trusting people to manage their own time off.
• Enhanced family leave.
• Employee assistance programme, plus EAP Wellbee.
• 4 volunteering days off.