Senior Application Security Engineer - Product Security & DevSecOps

In this role you own security across the SDLC and CI/CD pipelines, establishing secure delivery by default. You will manage the Ox Security ASPM platform, turning findings into prioritized remediation with engineering teams. You’ll define threat modelling, security testing, and guardrails integrated into the release process. You collaborate closely with Engineering and GRC to drive risk-informed decisions. This is a chance to shape secure software at scale for a platform used by leading financial institutions.

• Competitive salary
• Annual performance-based bonus
• Healthcare cashback and private medical insurance
• 4X salary life assurance
• Unlimited annual holiday
• Flexible working policy (2 days in office)

• Own secure SDLC and CI/CD pipelines, embedding secure delivery as the default
• Build and maintain pipeline security guardrails: SAST, SCA, secrets scanning, IaC and container image scanning with gating policies
• Strengthen software supply chain security: dependency hygiene, SBOMs, build provenance
• Define pre-deployment cloud guardrails through policy-as-code with Cloud & SecOps collaboration
• Own Ox Security ASPM platform: tune policies, reduce noise, prioritize findings by reachability/exploitability
• Drive remediation with engineering teams and set remediation SLAs
• Coordinate application penetration testing and track findings to remediation
• Lead threat modelling for new features and high-risk design reviews
• Promote secure coding practices and establish a security champions network
• Represent platform security in client reviews and inquiries; report security metrics and KRIs
• Support audits with evidence of secure development and release practices
• Monitor emerging threats, including AI/agentic security risks

• Proven experience in application security, product security or DevSecOps in SaaS
• Hands-on experience integrating security tooling into CI/CD pipelines
• Track record converting SAST/SCA/secrets/ASPM findings into prioritized remediation
• Strong knowledge of OWASP Top 10 and practical remediations
• Ability to read/review code in Java, Ruby or Python
• Experience facilitating threat modelling with engineering teams
• AWS knowledge and infrastructure-as-code familiarity
• Python or similar scripting language for automation
• Credibility with developers and ability to influence engineering teams
• Desirable: experience with Ox Security or ASPM, SBOMs and software supply chain concepts

• Influencing stakeholders
• Cross-functional collaboration
• Clear risk communication
• SAST
• SCA
• secrets scanning