> Markdown version of [/jobs/ext/2838473-senior-threat-modelling-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/2838473-senior-threat-modelling-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Threat Modelling & Application Security Engineer

- **Company:** Sanderson Recruitment Plc
- **Location:** London, UK
- **Experience:** Expert
- **Salary:** £117,000.0 - £130,000.0
- **Contract:** Temporary contract
- **Skills:** Amazon Web Services, Software System Penetration Testing, JIRA, User Authentication, Microsoft Azure, Cloud Computing, Cyber Security, Continuous Integration, Github, Python (Programming Language), Microsoft Security Essentials, MongoDB, Open Web Application Security, Google Cloud, Snowflake, Software Security, Mitre Att&ck, Cloudformation, Fastapi, Pytest, Kubernetes, Terraform, Serverless Computing, Docker, Databricks
- **Published:** September 11, 2026
- **Apply:** https://www.reed.co.uk/jobs/senior-threat-modelling-application-security-engineer/57336096

## About the Role

* 6+ years in IT, including 4+ years within Cyber Security.
 * Strong threat modelling and application security experience.
 * Knowledge of OWASP, CWE, authentication, authorisation, encryption and infrastructure security.
 * Experience with Terraform/CloudFormation, CI/CD and Jira.
 * Strong Python skills, including FastAPI and Pytest.
 * Experience within a regulated environment.

Desirable

 * Docker, Kubernetes, Helm, Serverless, GitOps and CDK.
 * Penetration testing exposure.
 * Snowflake, MongoDB, Databricks, GitHub and Terraform Cloud.

Certifications

 * Associate-level cloud certification (AWS, Azure, GCP or equivalent).
 * Cyber security certification such as CySA+, CISA, GSEC, SSCP or Microsoft Security certifications.

What You'll Bring

 * Strong analytical and problem-solving skills.
 * Excellent communication and stakeholder management.
 * An adversarial mindset and passion for continuous learning.
 * Ability to work independently and collaboratively across teams.

## Description

* Conduct threat modelling using STRIDE, PASTA, ATT&CK and Attack Trees.
 * Identify vulnerabilities and define mitigating security controls.
 * Review technical architectures and support secure SDLC processes.
 * Develop security automation tooling and Python-based applications.
 * Partner with engineering teams to embed security best practices.
 * Track threats and controls through to remediation and closure.


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [pytest: Simple, rapid and fun testing with Python](https://www.wearedevelopers.com/videos/213-pytest-simple-rapid-and-fun-testing-with-python)
- [Docker Compose: Rediscovered](https://www.wearedevelopers.com/videos/1978-docker-compose-rediscovered)
- [Improving quality with Agentic AI with Rovo Dev and Xray](https://www.wearedevelopers.com/videos/2005-improving-quality-with-agentic-ai-with-rovo-dev-and-xray)
- [Automagic Configuration in Python](https://www.wearedevelopers.com/videos/363-automagic-configuration-in-python)
- [Docker build without Docker](https://www.wearedevelopers.com/videos/100114-docker-build-without-docker)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)