Senior Security Engineer (EN/FR)

Are you a hands-on security professional ready to define application security in the age of agentic AI? Do you want to work somewhere that treats security as a competitive advantage and a core part of building trustworthy healthcare software? This is a broad, technical, high-ownership role for someone comfortable threat modelling AI-powered features, owning SAST and SCA pipelines, and contributing to ISO 27001 audits.

The role requires French and can be based in France or the UK. It is mostly remote, with access to our London and Paris offices.

About Semble

Semble’s mission is to help health professionals amplify their impact. Our secure, cloud-based clinical system is used by thousands of clinicians, improving healthcare delivery, reducing costs, and structuring health data to support research. We are guided by Impact, Collaboration, and Human touch , and we actively use AI to enhance how we work.

About the team and role

The IT Delivery & Security Services team builds secure, intuitive systems that simplify self-service, automate routine work, and remove barriers. We maintain high standards every day: our estate is patched, correctly provisioned, documented, and audit ready by default.

Reporting to the Head of Information Security and working alongside a Senior Technical Support Engineer, you will form the senior backbone of the team. This hire adds depth and maturity to a function previously carried by one person. You will own a broad portfolio spanning application security, secure SDLC enablement, AI governance, security operations, compliance, and security programmes, with significant autonomy to shape how the work gets done.

Semble’s product and architecture are evolving quickly, with AI becoming part of the core platform. You will help address changing attack surfaces and threats, including those introduced by agentic systems. This is a startup environment with varied work, a meaningful project backlog, and the opportunity to define best practice rather than simply follow it.

What you will do

Application Security and Secure SDLC

• Partner with engineering squads during planning, refinement, and delivery, embedding security into Agile workflows.
• Define and improve secure coding standards, design patterns, developer guidance, and frictionless guardrails such as pre-commit hooks, secure templates, and reference code.
• Lead threat modelling for new features and architectural changes, including AI and agentic capabilities, and capture abuse cases and security requirements early.
• Own SAST, SCA, DAST, container, and IaC scanning, primarily through Snyk Code, Open Source, Container, and IaC. Integrate with CI/CD, manage policies, improve developer experience, and reduce false positives.
• Manage vulnerabilities end to end, including classification, SLAs, remediation validation, reporting, and targeted developer training.

Security Architecture and Design

• Advise on authorisation, secrets and key management, data protection, zero-trust design, secure APIs, microservices, OAuth 2.0/OIDC, input validation, rate limiting, and session security.
• Review cloud-native services and edge components, balancing security with product goals.
• Advise on agent orchestration, tool integrations, memory handling, and MCP server deployments.

AI Security and Governance

• Address prompt injection, excessive agent autonomy, tool and plugin abuse, AI supply-chain risks, and context manipulation, using OWASP LLM and Agentic Applications guidance as a starting point.
• Help develop Semble’s AI governance posture with the Head of Information Security, aligned with ISO 42001 and the evolving healthcare AI regulatory landscape.
• Assess third-party AI integrations, AI-assisted development tools, and agentic workflows, implementing appropriate controls.

Security Operations and Threat Management

• Monitor, investigate, and respond to alerts, incidents, and anomalous behaviour.
• Mature threat intelligence, vulnerability management, penetration-testing coordination, incident response, logging, detection, and automation.
• Maintain application and AI incident runbooks, support blameless post-incident reviews, and feed lessons back into the SDLC.

Compliance, Certification and Audit Readiness

• Own or co-own programmes covering ISO 27001, Cyber Essentials+, NHS DSPT, SOC 2 readiness, and ISO 42001 implementation.
• Track practical KPIs including time to remediate, coverage, critical vulnerabilities resolved within SLA, threat-model coverage, and audit readiness.
• Maintain audit-quality documentation, evidence, and records continuously.

Customer and Stakeholder Engagement

• Support sales with customer security questionnaires and due diligence requests.
• Engage customers on security topics when needed and help internal stakeholders understand and embed security requirements.

What we are looking for

Required

• At least 5 years’ experience in application security, product security, or software engineering with strong AppSec ownership.
• Hands-on Snyk experience across SCA, SAST, Container, and IaC, including CI/CD integration and policy management.
• Strong knowledge of modern web, API, cloud-native, and application security, including OWASP Top 10 and API Security Top 10, plus an emerging understanding of the OWASP Top 10 for Agentic Applications.
• Experience embedding security in Agile and DevSecOps workflows.
• Practical knowledge of authentication and authorisation, secrets management, encryption, and cloud security controls.
• Experience with ISO 27001 and preferably Cyber Essentials+, NHS DSPT, or SOC 2.
• Practical understanding of AI security risks, including prompt injection, LLM vulnerabilities, and agentic threats, and how to mitigate them in products.
• SaaS or regulated-industry experience, with the ability to balance product, engineering, commercial, and security needs.
• Clear communication with engineers, leadership, and customers, translating complex risk into actionable language.
• Demonstrable use of AI to improve security operations, detection, or engineering workflows.
• A proactive ownership mindset, strong programme discipline, and a commitment to continuous audit readiness.
• French proficiency.

Desirable

• CISSP certification.
• Threat modelling experience, including STRIDE or attack trees.
• Familiarity with API gateways, container orchestration, software supply-chain security, AI-enabled features, ML pipelines, agentic workflows, or MCP integrations.
• Experience building or maturing security in a scaling organisation.
• Healthcare data regulation or NHS security experience.

What you will get

• The opportunity to help shape the future of healthcare.
• €90,000 to €100,000, depending on experience and value.
• Autonomy, ownership, and the trust to deliver.
• Generous holiday entitlement, including annual leave, RTT, public holidays, and three extra days for birthdays and wellbeing.
• Private health insurance, mental health support, and free therapy through Oli.
• Flexible hybrid working from France, with some flexibility across Europe.
• A latest-generation MacBook and a choice of home-office equipment.
• A knowledgeable, innovative team, including founders with a successful previous startup exit.
• A central Paris office at Cour Saint-Émilion, with a roof terrace, activities, natural light, and dogs, plus the usual office perks.

Semble welcomes applications from people of all backgrounds, including groups underrepresented in technology, disabled candidates, and neurodiverse candidates. Please tell us about any adjustments that would support you during the recruitment process.