AI Application Security Engineer (Java)

Caspian One; Greater London; On-site; GBP 70,000 - 110,000; Full time

Job summary

Caspian One partners with a leading Investment Bank to hire an experienced Application Security Engineer with a strong Java background. You will join a growing security function focused on identifying, validating, and driving remediation of vulnerabilities across a large banking environment.

The role sits at the intersection of AppSec, software engineering, and AI-driven security analysis, acting as the link between security and development teams to ensure risks are understood, owned, and

Qualifications

• Strong background in Application Security (AppSec).
• Experience with vulnerability triage and security assessments.
• Understanding of common vulnerabilities and attack paths.
• Experience with SAST and code analysis tooling.
• Ability to assess exploitability and business impact.

Responsibilities

• Review vulnerability findings and AI-assisted assessments.
• Validate genuine risks vs false positives.
• Investigate attack paths and exploitability.
• Collaborate with development teams to plan remediation.
• Explain security findings to technical and non-technical stakeholders.
• Ensure each vulnerability has an owner and plan.
• Track remediation and governance of findings.
• Help enhance AI-driven security tooling.
• Collaborate across Retail Banking, Investment Banking, Markets, and other units.
• Establish best practices for secure software development.

Skills

Application Security

Vulnerability triage

Security assessments

Java development

DevSecOps

Cloud-native apps

Containers

Cross-functional communication

Tools

SAST tooling

Code analysis tooling

Job description

Caspian One has partnered with a leading Investment Bank seeking an experienced Application Security Engineer with a strong Java engineering background to join a growing security function focused on identifying, validating, and driving remediation of application security vulnerabilities across a large banking environment.

As advances in AI continue to accelerate both software development and threat discovery, the ability to quickly identify, assess, and remediate exploitable attack paths has become increasingly critical. This role sits at the intersection of Application Security, Software Engineering, and AI-driven security analysis, acting as the key link between security teams and development teams to ensure identified risks are understood, owned, and remediated.

The successful candidate will combine hands-on development experience, ideally in Java, with a strong understanding of application security and secure software development practices.

Key Responsibilities

• Review and analyse application security findings, attack path reports, and AI-generated security assessments.
• Validate whether identified vulnerabilities are genuine risks or false positives.
• Investigate attack paths and determine exploitability within business-critical applications.
• Work directly with development teams to explain security findings and agree remediation plans.
• Challenge and validate technical assumptions made within security reports.
• Act as the security subject matter expert during discussions with engineering teams.
• Clearly articulate security risks and secure coding recommendations to both technical and non-technical stakeholders.
• Ensure every confirmed vulnerability has a clear owner and remediation plan.
• Track remediation activity through to completion and provide governance over outstanding findings.
• Support the ongoing enhancement of AI-driven security tooling and analysis frameworks used to identify application weaknesses.
• Collaborate with teams across Retail Banking, Investment Banking, Markets, and other business units.
• Help establish best practices for secure software development and vulnerability management.

Required Experience

Application Security

• Strong background in Application Security (AppSec).
• Experience performing vulnerability triage and security assessment reviews.
• Understanding of common application security vulnerabilities and attack paths.
• Experience working with SAST and code analysis tooling.
• Ability to assess exploitability and business impact of vulnerabilities.

Software Engineering

• 5+ years of software engineering and/or application security experience.
• Strong understanding of software development principles and secure coding practices.
• Hands-on Java development experience is essential.
• Ability to read, understand and analyse source code even if coding is not a core part of the role.
• Experience reviewing code to identify root causes and remediation approaches.

Stakeholder Management

• Strong communication and influencing skills.
• Comfortable challenging technical stakeholders where required.
• Experience working directly with engineering teams to drive remediation activities.
• Ability to explain complex security issues in a clear, pragmatic manner.
• Confident operating within large-scale engineering organisations.
• Background as a Software Engineer who has transitioned into Security.
• Experience working within DevSecOps environments.
• Familiarity with AI-powered developer and security tooling.
• Experience using or supporting AI agents, copilots, or security-focused LLM solutions.
• Knowledge of cloud-native application environments and containers.
• Experience with vulnerability management and security governance processes.