Senior Application Security Engineer

Senior Application Security Engineer | London, Hybrid

You’ll own security across the software development lifecycle, making secure delivery the default for engineering teams from design and code through to release. You’ll also own the ASPM platform (Ox Security) and turn its findings into fixes that actually ship.

• Salary: competitive, plus annual performance bonus
• Location: London, hybrid (2 days a week in the office)
• Level: Senior, reporting to the Head of Information Security

You’ll join a small Information Security team across London and Poland at an enterprise SaaS company whose clients include major global banks.

Senior Application Security Engineer - What you’ll actually do:

• Build and maintain CI/CD guardrails: SAST, SCA, secrets scanning, and IaC and container image scanning, with gating agreed with Engineering
• Tune Ox Security to cut noise and prioritise findings by reachability and exploitability
• Agree remediation SLAs with engineering leads and report clearly on progress
• Lead threat modelling and secure design reviews, and review high-risk code changes
• Strengthen supply chain security through SBOMs, dependency hygiene and build provenance
• Represent platform security in client security reviews and due diligence

Senior Application Security Engineer - What you’ll need:

Essential:

• Experience in application security, product security or DevSecOps, ideally in SaaS
• Hands-on integration of security tooling into CI/CD pipelines
• A track record of turning SAST, SCA, secrets or ASPM findings into prioritised, remediated work
• Strong understanding of the OWASP Top 10 and how to remediate it
• Ability to read and review code in Java, Ruby or Python
• Experience running threat modelling with engineering teams, plus working knowledge of AWS and infrastructure-as-code

Nice to have:

• Ox Security or another ASPM platform
• A software engineering background before security
• Supply chain security (SLSA, SBOMs, artefact signing) or Kubernetes and policy-as-code experience
• Securing LLM or agentic AI features, for example using the OWASP Top 10 for LLM Applications

What’s in it for you

• Private medical insurance, healthcare cashback scheme and 4x salary life assurance
• Unlimited annual holiday and enhanced family leave
• Work abroad for up to 6 weeks a year
• Learning and development budget, 4 volunteering days, Cycle to Work and Tech Scheme

If you meet most but not all of the essentials, we’d still like to hear from you.

LT Harper is handling this search on our client’s behalf. If you’re interested, apply directly on this advert. If you have any questions, or would like to refer someone, reach out to Adam Sawa at [email protected].