Application Security & DevSecOps Specialist

VIQU IT; City Of London; Hybride; GBP 77 000 - 94 000; Plein temps

Avantages offerts par ce poste

Referral bonus

Résumé du poste

VIQU IT in London is recruiting an Applications Security & DevSecOps Specialist for a hybrid role. The position focuses on strengthening application security, embedding automated security testing into development pipelines, and managing external attack surface risks.

You will work with engineering, DevOps, and security teams to remediate vulnerabilities, support secure AI technologies, and improve security practices across the organisation.

Qualifications

• Proven experience in Application Security, DevSecOps, or a similar hands-on cyber security role.
• Experience with SAST, DAST, and SCA tools.
• Ability to integrate automated security testing into CI/CD pipelines.
• Experience with attack surface management and external exposure monitoring.
• Knowledge of CVSS and risk prioritisation frameworks.
• Awareness of AI security risks and secure AI practices.

Responsabilités

• Implement and manage application security testing across the software development lifecycle (SAST, DAST, SCA).
• Integrate automated security scanning and controls into CI/CD pipelines (shift-left security).
• Manage and validate application vulnerabilities through manual testing and remediation tracking.
• Oversee external attack surface management and risk identification of exposed assets.
• Configure and maintain security testing tools with effective coverage and reporting.
• Collaborate with development teams to improve secure coding practices.

Connaissances

Application Security

DevSecOps

CI/CD pipelines

Security communication

Outils

Checkmarx

Snyk

Semgrep

Burp Suite

OWASP ZAP

Description du poste

Application Security & DevSecOps Specialist

London - Hybrid (3DPW in office)

Up to £85,000

VIQU have partnered with a leading organisation seeking an Application Security & DevSecOps Specialist to join their cyber security function. This is a hands-on technical role focused on strengthening application security, embedding automated security testing into development pipelines, and managing external attack surface risks. The successful candidate will work closely with engineering, DevOps, and security teams to identify and remediate vulnerabilities, whilst supporting the adoption of secure AI technologies and improving security practices across the organisation.

Key Responsibilities of the Application Security & DevSecOps Specialist:

• Implement and manage application security testing across the software development lifecycle, including SAST, DAST, and SCA
• Integrate automated security scanning and vulnerability controls into CI/CD pipelines, supporting a shift-left security approach
• Manage and validate application vulnerabilities through manual testing, risk assessment, and remediation tracking
• Oversee external attack surface management, identifying exposed assets, domains, misconfigurations, and security risks
• Configure and maintain application security and vulnerability scanning tools, ensuring effective coverage and reporting
• Work closely with development and engineering teams to address security vulnerabilities and improve secure coding practices
• Assess security risks associated with AI applications, large language models, and machine learning technologies
• Support the implementation of AI security controls and explore opportunities to enhance cyber defence through automation
• Produce security metrics and reports covering vulnerabilities, remediation progress, and overall security posture

Key Experience Required of the Application Security & DevSecOps Specialist:

• Proven experience in Application Security, DevSecOps, or a similar hands-on cyber security role
• Strong experience with SAST, DAST, and SCA tools such as Checkmarx, Snyk, Semgrep, Burp Suite, or OWASP ZAP
• Experience integrating automated security testing and controls into CI/CD pipelines
• Demonstrable ability to investigate, validate, and remediate application security vulnerabilities
• Experience with attack surface management, asset discovery, domain security, and external exposure monitoring
• Knowledge of vulnerability assessment tools such as Shodan and risk prioritisation frameworks including CVSS
• Strong understanding of secure software development practices, API security, and common application vulnerabilities
• Awareness of emerging AI security risks, including prompt injection, data poisoning, and vulnerabilities affecting large language models
• Familiarity with security frameworks such as OWASP Top 10 and MITRE ATLAS would be advantageous
• Excellent communication and stakeholder management skills, with the ability to work collaboratively across technical teams

Do you know someone great? We'll thank you with up to £1,000 if your referral is successful (terms apply).