Application Security Engineer

• Define consistent Secure Software Development Lifecycle practices for technology projects throughout planning and delivery.
• Help ensure application security vulnerabilities are mitigated to tolerable levels.
• Work with software and security engineers to design, maintain, and build product security tools and services.
• Act as the technical point of contact for product teams on automation, CI/CD, and Product Application Security Operations.
• Use approved AI models and cyber harnesses to assess application code for business logic weaknesses, misconfiguration, and vulnerabilities.
• Build tools and automation scripts that help developers consume security services delivered by the Security Engineering and Automation team.
• Be responsible for security product QA and testing.
• Build strong relationships with product development teams.
• Run software composition analysis (SCA) tools.
• Explain penetration testing findings to software engineering teams and help triage and mitigate risks.
• Articulate business risk when assessing software vulnerabilities.
• Continuously improve the operations of SAST, DAST, and IaC security tools.
• Continuously improve the operations of Web Application Firewalls (WAF) or IDS.
• Continuously improve security tooling coverage in cloud environments such as Microsoft Azure and Amazon AWS.

Technologies:

• Agentic AI
• AI
• AWS
• Azure
• C#
• CI/CD
• Cloud
• Copilot
• DevOps
• GitHub
• Support
• JavaScript
• LESS
• OWASP
• PowerShell
• Python
• Security
• WAF
• Web

• We are looking for a cybersecurity engineer with expertise in the application security domain.
• We need strong application security and web application development experience.
• We need team leadership skills and the ability to join a growing Information Security team.
• We need deep understanding of OWASP, CWE 25, data protection, access management, software vulnerabilities, best-practice design, and threat modelling.
• We need experience working with developers to produce secure code in short time frames.
• We need a Computer Science or Cyber Security degree.
• We need an application development background.
• We need Azure DevOps experience.
• We need prior experience using AI models and cyber harnesses to support security evaluation of application and software code.
• We need experience with GitHub, Copilot, Codex, OWASP Top 10 for Agentic AI, AI skills development, and security triage.
• We need the ability to code in at least one programming language, such as Python, JavaScript, C#, or PowerShell.
• We prefer prior experience in a large organisation or Financial Services.
• We need excellent analytical skills and attention to detail.
• We need a CISSP, CSSLP, CEH, OSCP, or similar certification.
• We need presentation skills and the ability to explain complex solutions to a less technical audience.
• We need strong interpersonal, teamwork, communication, and collaboration skills.
• We need excellent written and spoken English.
• We want someone passionate about developing a career in Information Security.
• We want someone who is inspired by agile leadership, continuous improvement, and problem solving.

We are a global investment manager helping institutions, intermediaries, and individuals around the world invest money to meet their goals, fulfil their ambitions, and prepare for the future. We have around 5,000 people across six continents and have been established for over 200 years, while continuing to adapt as society and technology change. What does not change is our commitment to helping clients and society prosper. This is a contract inside IR35 role based in London on a hybrid working pattern.