> Markdown version of [/jobs/ext/2930320-security-architect-devsecops-application-security](https://www.wearedevelopers.com/jobs/ext/2930320-security-architect-devsecops-application-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Architect - DevSecOps Application Security - **Company:** Colt Technology Services - **Location:** London, UK (Remote available) - **Experience:** Expert - **Salary:** £59,050.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Applications Architecture, Software System Penetration Testing, Architectural Patterns, User Authentication, Automation of Tests, Microsoft Azure, Cloud Computing, Cloud Engineering, Cyber Security, Continuous Integration, DevOps, Open Web Application Security, Secure Coding, Session Management, Software Engineering, Systems Integration, Spring Cloud, Delivery Pipeline, Large Language Models, Software Security, Gitlab, Devsecops, Static Application Security Testing, Microservices, Dynamic Application Security Testing - **Published:** September 16, 2026 - **Apply:** https://www.adzuna.co.uk/jobs/details/5885291931 ## About the Role * 5+ years of experience in information security, with a strong focus on application security and DevSecOps * Strong understanding of secure software development practices and common application security risks (e.g. OWASP Top 10) * Hands-on experience working with or integrating DevSecOps tooling within CI/CD environments (e.g. GitLab pipelines) * Experience with application security testing tools and practices, including: SAST, DAST, SCA / dependency scanning and Secrets / credentials scanning. * Experience contributing to security design reviews for applications and APIs * Experience supporting or participating in penetration testing activities, including remediation tracking * Strong understanding of modern application architectures (e.g. APIs, microservices, cloud-native applications) * Knowledge of authentication and session management concepts within applications * Experience performing or supporting risk assessments aligned to recognised frameworks * Ability to translate technical vulnerabilities into business-aligned risk and remediation actions * Strong collaboration skills with engineering and development teams * Strong communication skills (technical and non-technical) Might haves: * Experience with GitLab security tooling and pipeline integrations * Familiarity with cloud-native application security (Azure / GCP environments) * Exposure to API security controls and testing approaches * Basic understanding of AI/LLM application risks, such as prompt injection or data exposure * Experience working within regulated environments (telecommunications, financial services, critical infrastructure) * Understanding of Telecoms Security Act (TSA) requirements in application design ## Description We are looking for a Security Architect specialising in Application Security and DevSecOps to join the Security and Resilience - Security Architecture team. This role will act as a subject matter expert for secure software development and DevSecOps practices, supporting the integration of security controls into Colt's development pipelines and ensuring applications are secure by design and by default. The successful candidate will work closely with Engineering, DevOps, Cloud, SOC and Risk teams to embed security throughout the software development lifecycle, ensuring that Colt's applications and services are designed, built and tested with security as a core requirement. The role combines: * Application security architecture and design * DevSecOps pipeline integration and tooling * Security assurance and governance across internally developed applications You will play an important role in supporting: * Secure software development practices across Colt * Security integration into CI/CD pipelines (GitLab) * Reduction of vulnerabilities through automated scanning and testing * Assurance of internet-facing applications through structured penetration testing activities * Provide security architecture expertise for application security and DevSecOps, supporting standards and best practices across the software development lifecycle * Contribute to the target architecture for secure software development, aligned to Colt's Secure by Design principles * Support the integration of security controls into CI/CD pipelines (GitLab), including automated testing and policy enforcement * Design and implement application security controls, including: + Static Application Security Testing (SAST) + Dynamic Application Security Testing (DAST) + Software Composition Analysis (SCA) / dependency scanning + Secrets and credentials scanning * Work with engineering teams to ensure consistent adoption of DevSecOps practices and secure coding approaches * Support security architecture reviews and assurance activities for internally developed applications and services * Identify and help reduce risks related to application vulnerabilities, insecure coding practices and exposed credentials * Support the coordination and execution of third-party penetration testing of Colt's internet-facing applications * Assist in defining test scope, tracking execution and ensuring remediation of findings is properly managed * Provide guidance to engineering teams on remediation and prioritisation of vulnerabilities * Contribute to the development and maintenance of secure coding standards and architectural patterns * Ensure alignment with regulatory requirements such as TSA, DORA and ISO27001 in application design and deployment * Promote a security-first culture within development teams, including awareness and best practices * Maintain awareness of emerging risks and technologies, including basic AI/LLM-related application risks, and support translation into practical controls where required * Produce and maintain architecture artefacts, standards and guidance documentation ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [WeAreDevelopers LIVE - Modern DevOps for IoT Devices and More](https://www.wearedevelopers.com/videos/1805-wearedevelopers-live-modern-devops-for-iot-devices-and-more) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [Enabling automated 1-click customer deployments with built-in quality and security](https://www.wearedevelopers.com/videos/83-enabling-automated-1-click-customer-deployments-with-built-in-quality-and-security) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)