> Markdown version of [/jobs/ext/3862886-application-security-engineer-appsec-devsecops](https://www.wearedevelopers.com/jobs/ext/3862886-application-security-engineer-appsec-devsecops). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer - AppSec/DevSecOps

- **Company:** WNTD Ltd
- **Location:** London, UK
- **Contract:** Temporary contract
- **Skills:** JavaScript (Programming Language), Amazon Web Services, Application Firewall, Business Logic, Software System Penetration Testing, Automation of Tests, Microsoft Azure, C Sharp (Programming Language), Cloud Computing Security, Cyber Security, Continuous Integration, Web Development, Github, Identity and Access Management, Intrusion Detection Systems, Python (Programming Language), Machine Learning, Open Web Application Security, Windows PowerShell, Microsoft Copilot, Secure Coding, Software Engineering, Software Security, Agentic-AI, Information Technology, Tenable Nessus, Software Coding, Devsecops, Security Orchestration, Automation & Response, Static Application Security Testing, Dynamic Application Security Testing
- **Published:** October 22, 2026
- **Apply:** https://www.careerboard.com/gb/en/find-jobs-in-United-Kingdom/-0B03D373437062CC1C/

## About the Role

* Strong hands-on Application Security/AppSec experience, supported by an application or web development background.
 * Ability to code in at least one language, such as Python, JavaScript, C# or PowerShell.
 * Experience with Azure DevOps, CI/CD pipelines, security automation and secure software delivery.
 * Practical experience with application security scanning tools, vulnerability triage and remediation.
 * Strong understanding of OWASP Top 10, common software weaknesses, threat modelling and secure coding.
 * Previous use of AI models and security evaluation harnesses to assess application or software code.
 * Experience with GitHub and AI coding/security tools such as Copilot or Codex, alongside awareness of OWASP Top 10 for Agentic AI.
 * Ability to work collaboratively with developers and explain complex security findings clearly.
 * A Computer Science/Cyber Security degree and a relevant certification such as CISSP, CSSLP, CEH, OSCP or similar.

Desirable experience

 * Financial services or another large enterprise environment.
 * Cloud security tooling across Microsoft Azure and/or AWS.
 * Web Application Firewalls (WAF) or Intrusion Detection Systems (IDS).
 * Technical leadership and mentoring within application security.

## Description

WNTD is seeking an Application Security Engineer for a six-month contract supporting a global investment management organisation in London.

This hands-on role combines application security, secure software development and DevSecOps. You will work closely with developers to identify and resolve vulnerabilities, automate security services and embed security throughout the software development lifecycle.

The role also requires practical experience using AI models and security evaluation tools to assess application code., * Embed secure software development lifecycle (SSDLC) practices across technology projects.

 * Build and maintain application security tools, services and automation scripts.
 * Integrate security testing into CI/CD pipelines and support development teams using Azure DevOps.
 * Operate and improve static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA) and infrastructure-as-code (IaC) security tooling.
 * Use approved AI models and security evaluation harnesses to identify code vulnerabilities, business logic weaknesses and misconfigurations.
 * Help developers interpret penetration testing findings, prioritise vulnerabilities and implement fixes.
 * Conduct threat modelling and provide guidance on secure design, coding, access management and data protection.
 * Improve security tooling coverage across Azure and AWS environments, alongside WAF or IDS capabilities.
 * Test security products and communicate application security risks to technical and business stakeholders.