> Markdown version of [/jobs/ext/85234-senior-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/85234-senior-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Application Security Engineer - **Company:** Cloudsmith - **Location:** Belfast, UK - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Amazon S3, Business Logic, Software as a Service, Cloud Computing, Cloud Computing Security, Code Review, Databases, Continuous Integration, Data Security, Data Stores, DevOps, Programming Tools, Github, Identity and Access Management, Python (Programming Language), Apache Maven, Metadata, Open Source Technology, Open Web Application Security, Zero Trust Network Access, Software Engineering, Tripwire, TypeScript, Datadog, Data Logging, Okta, Software Security, Caching, Deep Web, GWAPT, HuggingFace, Production Code, Graphql, Terraform, Oracle Cloud Infrastructure, Docker, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** May 25, 2026 - **Apply:** https://uk.indeed.com/viewjob?jk=b987c92efdc5141d ## About the Role Do you have experience in TypeScript?, * Around 5+ years of hands-on application security experience, or equivalent experience across software engineering and security, with security as your recent focus. * Deep software engineering craft, with a focus on Python. Familiarity with TypeScript, Go, or Rust is an advantage. Effective use of ownership-driven AI is useful. * Deep web and API security knowledge: OWASP Top 10, business logic flaws, authn/authz design, token handling, REST, GraphQL, and multi-tenant access control. * Practical threat modeling and vulnerability research experience against real applications, APIs, cloud-native systems, and distributed services. * Strong cloud-native security experience, especially across AWS, IAM, KMS, S3, containers, Terraform, CI/CD, secrets handling, logging, and multi-tenant isolation. * Sound judgment on vulnerability priority. You understand CVSS, but you care more about exploitability, reachability, tenant impact, and production reality. * Ability to reason through production systems: APIs, queues, caches, databases, workers, CDNs, object storage, edge delivery, telemetry, and failure modes. * Clear communication in a remote-first environment. Your threat models, risk write-ups, incident notes, and feedback should be useful to engineers and credible to leadership., * Experience securing artifact management, package registry, container registry, CI/CD, DevOps, developer tooling, or supply chain security platforms. * Experience with secure runtime environments, sandboxing, workload isolation, policy engines, OPA/Rego, eBPF, or similar control points. * Contributions to open-source security tooling or supply chain security projects. * Familiarity with Datadog, AWS Security Hub, Okta, GitHub Advanced Security, Snyk, Semgrep, Trivy, Wiz, or similar tooling. * Useful, but not required: certs such as OSCP, CSSLP, GPEN, GWAPT, GCSA, or CISSP., * Builder mindset: You fix code and automate the boring parts to accelerate others. * Practical paranoia: You can think like an attacker without losing sight of practicality. * High standards, low ego: You raise the bar without devolving into arguments. * Clear thinking: You can turn messy problems into decisions and trade-offs. * Ownership: You care deeply about the security of the product, platform, and company. ## Description As a Senior Application Security Engineer, you'll report to the Head of Security and embed directly into one of our engineering tribes. You'll work alongside Engineering Managers, Product Managers, Principal Engineers, and product engineers as part of the tribe's day-to-day rhythm. Your job is to advocate for security from within the core engineering function, not from the sidelines. That means joining design discussions early, reviewing code and architecture, identifying risks early, and helping the tribe land secure, pragmatic fixes. We are building a model where security engineers are part-IC, part-security specialist. You should be able to contribute directly, but your greater leverage lies in raising the security judgment of the engineers around you, so good security becomes part of how we work., * Embed inside an engineering tribe and participate in planning, design review, code review, incident learning, and delivery conversations. * Collaborate across security, platform, and engineering guilds so security work routes to the right team, at the right time, with the right priority. * Threat-model product and platform changes across APIs, workers, data stores, queues, object storage, CDNs, identity, policy, and tenant boundaries. * Review production code and architecture for authentication, authorization, data access, secrets handling, artifact integrity, signing, auditability, and abuse cases. * Build and improve security tooling, paved roads, checks, libraries, and automation that make securing Cloudsmith easier for engineers. * Tune and operate security controls across SAST, DAST, SCA, secrets scanning, container scanning, IaC scanning, dependency analysis, and runtime signals. * Investigate, triage, and remediate vulnerabilities identified through internal testing, third-party testing, responsible disclosure, customer reports, and security tooling. * Support security incidents, red/blue exercises, detection work, and post-incident actions, improvements, and other investigatory/preventative follow-ups. * Support technical control work for SOC 2, ISO 27001, EU CRA, and related frameworks, working with GRC where security engineering input is needed. * Raise the tribe's security capability by helping engineers understand risks, threat-model their own work, and recognize what good secure design looks like., Cloudsmith is not just another SaaS product. We are the artifact control plane for our customers' software supply chains. You should understand, or be excited to go deep on: * Ecosystems such as npm, PyPI, Docker/OCI, Maven, Helm, and Hugging Face. * Software supply chain threats such as dependency confusion, typosquatting, malicious packages, maintainer compromise, metadata poisoning, and build-system injection. * Artifact and registry concepts: immutable blobs, mutable metadata, package identity, checksums, upstream proxying, private repos, access control, caching, and promotion. * Provenance and trust mechanisms such as SBOMs, signing, attestations, SLSA, Sigstore, in-toto, trusted publishing, and zero-trust software delivery. ## Related Videos - [Docker Compose: Rediscovered](https://www.wearedevelopers.com/videos/1978-docker-compose-rediscovered) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Docker build without Docker](https://www.wearedevelopers.com/videos/100114-docker-build-without-docker) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Software Security 101: Secure Coding Basics](https://www.wearedevelopers.com/videos/220-software-security-101-secure-coding-basics) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) ## Related Articles - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)