> Markdown version of [/jobs/ext/3858726-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/3858726-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer

- **Company:** Centrica
- **Location:** Windsor, UK
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, JavaScript (Programming Language), Amazon Web Services, Applications Architecture, Microsoft Azure, DevOps, Github, Python (Programming Language), Network Protocols, OAuth, OpenID, Open Web Application Security, Ansible, Security Assertion Markup Language (SAML), SAP (Applications), Secure Coding, Software Engineering, Tripwire, Software Vulnerability Management, Delivery Pipeline, Software Security, Multi-Cloud, GWAPT, Bicep, Terraform, Devsecops, Security Orchestration, Automation & Response, Static Application Security Testing, Programming Languages, Microservices, Dynamic Application Security Testing
- **Published:** October 22, 2026
- **Apply:** https://www.apply4u.co.uk/jobs/application-security-engineer/52859830

## About the Role

What you would bring - Strong hands-on experience in application security, with a solid understanding of secure software development, OWASP Top 10, common application vulnerabilities and secure SDLC practices.
Proficiency in one or more programming languages, such as Python or JavaScript, with experience using code to support security automation, tooling, custom rule development or other clever ways to make security scale.
Experience working across cloud platforms such as AWS, Azure or SAP, alongside a good understanding of modern application architectures, container security, API security, network protocols and identity frameworks such as OAuth 2.0, OIDC and SAML.
A strong working knowledge of DevOps pipelines, repositories and CI/CD security integration, including platforms such as Azure DevOps and GitHub Actions, with the confidence to bring security into delivery without slowing everyone down.
Practical experience with security tooling and practices including SAST, DAST, SCA, container scanning, vulnerability management, SBOM tooling such as CycloneDX, IaC security across Terraform, Bicep, Ansible and tools such as Trivy, plus Policy as Code and threat modelling.
A proactive, curious and collaborative approach, with the ability to guide engineering teams, support third-party supply chain security and make complex topics feel practical; desirable extras include certifications such as GWAPT, GWEB, OSCP or AWS Security Specialty, Security Champions or developer training experience, and exposure to SOC or Incident Response environments.

## Description

An opportunity to play your part - Are you passionate about building security into the heart of modern software delivery? We're looking for an experienced Application Security Engineer to help strengthen secure development practices across Centrica's multi-cloud environment, with a key focus on AWS, Azure DevOps and modern DevSecOps tooling. This is a brilliant opportunity to work closely with engineering, platform and security teams to reduce risk, improve our security posture and make secure, automated and scalable delivery feel like second nature. You'll help define and embed application standards, champion developer enablement and play an important role in shaping Centrica's wider security capability. If you love the idea of helping teams move fast without leaving security behind, this role gives you the chance to bring your expertise, curiosity and practical problem-solving to work that really matters.
Location: UK-based hybrid role, Occasional travel to site.
Day to day -Collaborate with DevOps and engineering teams to weave security best practice into the software development lifecycle, helping teams deliver at pace without compromising on protection.
Provide practical guidance on secure design, implementation and architecture, including API security, microservices patterns and cloud-native application security.
Carry out ongoing manual security assessments, coordinate third-party engagements where needed, and turn findings into clear, prioritised actions.
Review SAST, DAST and SCA outputs, driving remediation through to closure and keeping tracking, ownership and prioritisation firmly on course.
Provide on-demand application security support while driving continuous improvement across processes, tooling and ways of working, making security simpler, smarter and more scalable.
Lead or contribute to the Security Champions programme and work closely with GSOC and CSIRT teams on application-layer security incidents, helping build a strong, distributed security culture across engineering.