Application Security Engineer

Key Responsibilities

• Fix complex application security vulnerabilities directly, including architectural weaknesses and issues in legacy technology that automated remediation cannot yet handle safely.
• Lead remediation of problems that cross team and system boundaries, coordinating changes across multiple owners and services and seeing them through to resolution.
• Resolve authentication and authorisation weaknesses, including identity, access control, session and token handling, service-to-service trust and permission models.
• Act as a dedicated delivery vehicle for security remediation, reducing the fix burden on engineering teams so they can focus on product delivery.
• Interpret the output of security tooling (e.g., SAST, DAST, SCA, secrets, container and IaC scanning), validate findings, identify root causes and implement the right fix rather than only triaging.
• Secure agentic and AI-enabled systems, assessing and mitigating risks such as those in the OWASP Top 10 for Agentic Applications, including prompt injection, excessive agent permissions, tool misuse, insecure agent-to-agent communication and unsafe handling of agent outputs.
• Contribute to the development of our internal coding agent platforms, including remediation agents, by supplying specialist fixes, remediation patterns, evaluation cases and feedback on where agents succeed or fail.
• Define and build guardrails for agent-generated and human-written changes (e.g., least-privilege agent access, human approval points, secure defaults, shared libraries, pipeline checks and policy-as-code) so that changes are safe and vulnerabilities do not recur.
• Build and secure GitHub workflows and release pipelines, including GitHub Actions hardening, secrets and token handling, branch protection, dependency and supply chain controls, and security gates in CI/CD.
• Plan and deliver higher-risk changes safely, including testing, peer review, rollout and rollback approaches, in partnership with the teams that own the systems.
• Work with the teams that detect, prioritise and track vulnerabilities to take prioritised findings through to remediation, and identify recurring fix types that can be automated safely.
• Document remediation approaches, share knowledge and coach engineers on secure design, secure coding and the safe use of AI coding agents.
• Report on remediation progress, including backlog reduction, SLA performance and risk reduction, and provide evidence to support audit and regulatory requirements.

Requirements & Tech Stack

Engineering Skills

• Full stack engineering experience across front end, back end and APIs, with proficiency in one or more languages (e.g., Java, Python, C#, JavaScript/TypeScript) and the ability to work in unfamiliar and legacy codebases.
• Strong hands-on experience with GitHub (pull requests, code review, branch protection, code scanning) and GitHub Actions, including building and securing release pipelines.
• Working knowledge of cloud platforms, containers and infrastructure as code.
• Ability to review code, find vulnerabilities and implement practical, correct fixes.

Application Security Skills

• Strong application security knowledge, including the OWASP Top 10 and common vulnerability classes such as injection, broken access control, insecure deserialization and cryptographic weaknesses.
• Deep understanding of authentication and authorisation, including OAuth 2.0, OIDC, SAML, JWT and session handling, RBAC/ABAC models and service-to-service identity.
• Hands-on experience interpreting application security tooling output (SAST, DAST, SCA, secrets, container and IaC scanning), distinguishing true and false positives and finding root cause.
• Understanding of CI/CD and software supply chain security, including GitHub Actions risks such as untrusted input, over-privileged tokens and third-party action pinning.

AI & Agentic Security Skills

• Day-to-day experience using coding agents such as Claude to write, review and fix code, with sound judgement on where they are reliable and where they are not.
• Knowledge of and informed opinions on the OWASP Top 10 for Agentic Applications and related AI security risks, including prompt injection, tool and permission abuse, data leakage and agent identity.
• Ability to design guardrails, permission boundaries and evaluation approaches for AI agents and agent-generated changes.
• Ability to turn manual fixes into repeatable patterns and test cases that agent platforms can use.

Remediation & Architecture Skills

• Experience fixing architectural and design-level security issues, and making safe changes in systems with limited tests, documentation or clear ownership.
• Ability to plan and deliver changes that span multiple teams and services, managing dependencies and risk.
• Sound judgement on testing, rollout and rollback for higher-risk changes.

Collaboration & Communication Skills

• Ability to work as a trusted partner to engineering teams, explaining why a fix is needed and making it easy to adopt.
• Influence without direct authority across teams that own the affected systems, including stakeholders in different locations and time zones.
• Clear written and verbal communication, including documentation and progress reporting.

Mindset & Attributes

• Ownership and a bias to action: comfortable taking on ambiguous, hard problems and seeing them through to resolution.
• Pragmatic, risk-aware judgement when balancing speed of remediation against the risk of change.
• Curiosity and continuous learning as threats and agentic technologies evolve.

What We Offer

• Health & Protection: Medical cover for you, your family & parents; life and accidental cover at a multiple of your salary
• Wellbeing: Annual health check-ups, online doctor consultations, pharmacy discounts, nutritionist support, and an Employee Assistance Programme — all sponsored
• Time Off: Earned, casual/sick leave, public holidays, maternity & paternity leave
• Life Milestones: A financial gesture of support at marriage, childbirth, and bereavement
• Flexible Benefits: Tax-efficient allowances for internet, fuel, meals, leave & travel, and NPS
• Growth: Professional certification support, learning & development opportunities, childcare benefits, and paid volunteering days
• Our Workplace: Modern central offices, weekly business updates, team events, and great coffee — we work hard to build a culture worth showing up for