Application Security Engineer

Spencer Rose Ltd; Easter Howgate; On-site; GBP 77,000 - 94,000; Full time

Job summary

Spencer Rose Ltd is seeking an experienced Application Security Engineer to join our Security Engineering team on a 12-month fixed-term contract in Edinburgh. You will work hands-on with software engineers, architects and product leaders to embed security into products and delivery from the outset.

You will lead threat modelling, security design reviews and provide pragmatic guidance on secure architecture, secure coding and cloud security controls across applications, APIs and CI/CD.

Qualifications

• Extensive experience in application security across products and services.
• Ability to lead threat modelling and security design reviews.
• Hands-on guidance on secure coding, architecture and security controls.

Responsibilities

• Partner with engineering and product teams to understand systems and security needs.
• Lead threat modelling activities and security design reviews.
• Provide guidance on secure architecture and coding practices.
• Support Secure by Design principles across SDLC.
• Embed security tooling and automated controls in CI/CD pipelines.
• Assess vulnerabilities and coordinate remediation plans.

Skills

Application Security

Threat Modelling

SSDLC

DevSecOps

Security Architecture

Tools

Java

Spring Boot

React

Kubernetes

AWS

Azure

Job description

Application Security Engineer1 2-Month Fixed-Term Contract

Edinburgh - £85K

We're looking for an experienced Application Security Engineer to join our Security Engineering team on a 12-month fixed-term contract.

This is a hands-on role Embedded within product and engineering teams, helping to ensure security is built into products and services from the outset. You'll work closely with software engineers, architects and product leaders to identify risks early, influence technical decisions and enable secure delivery without slowing innovation.

If you enjoy solving complex security challenges, collaborating with development teams and translating security requirements into practical solutions, we'd love to hear from you.

What You'll Be Doing

As the dedicated Application Security Engineer supporting a portfolio of customer-facing and enterprise platforms, you will:

• Partner with engineering, architecture and product teams to understand systems, data flows, business priorities and security requirements.
• Lead threat modelling activities and security design reviews to identify risks during solution design and development.
• Provide pragmatic guidance on secure application architecture, secure coding practices and security controls across applications, APIs, cloud services and integrations.
• Support the adoption of Secure by Design principles throughout the software development lifecycle.
• Collaborate with development teams to embed security tooling and automated controls within CI/CD pipelines.
• Assess and prioritise security vulnerabilities, helping teams understand risk and implement effective remediation plans.
• Coordinate penetration testing activities and support remediation, validation and risk management processes.
• Perform security assessments of SaaS solutions, third-party vendors and external integrations.
• Work closely with Cloud Security, Identity & Access Management and Security Operations teams to manage cross-functional security risks.
• Represent application security interests within project and governance forums, providing balanced, risk-based security advice.
• Contribute to the continuous improvement of application security standards, frameworks and operational processes.
• Maintain clear documentation of security assessments, risks, decisions and recommendations.

About You

You're a collaborative security professional who understands that effective security is achieved through partnership, influence and practical problem-solving.

Rather than simply identifying issues, you work alongside engineering teams to find solutions that balance security, delivery and business outcomes.

You'll have experience in several of the following areas:

• Application Security
• Product Security
• Secure by Design
• Threat Modelling
• Security Architecture Reviews
• Vulnerability Management
• Secure Software Development Lifecycle (SSDLC)
• DevSecOps and CI/CD Security
• Security Risk Assessment
• Application and API Security Testing

Experience with technologies such as Java, Spring Boot, React, Node.js, Snowflake, Salesforce, Kubernetes, OpenShift, Snyk, Wiz, GitHub Advanced Security, Azure or AWS would be advantageous, although we welcome candidates with transferable experience across different technology stacks.

What We're Looking For

We're interested in individuals who can combine technical depth with strong stakeholder engagement.

You'll ideally bring:

• Experience in an Application Security, Product Security, Security Engineering or Secure Software Engineering role.
• Strong knowledge of application and API security risks, including authentication, authorisation, session management, cryptography, data protection and security misconfiguration.
• Experience facilitating threat modelling workshops using methodologies such as STRIDE, PASTA or ATT&CK.
• Hands-on experience with security testing approaches, including:
  • Static Application Security Testing (SAST)
  • Software Composition Analysis (SCA)
  • Secrets Detection
  • Dynamic Application Security Testing (DAST)
  • API Security Testing
  • Container and Infrastructure Scanning
• Experience interpreting and prioritising vulnerabilities based on technical impact, exploitability and business risk.
• Familiarity with modern cloud-native environments, CI/CD pipelines and containerised applications.
• Strong communication and stakeholder management skills, with the ability to influence technical and non-technical audiences at all levels.
• Relevant certifications such as CSSLP, GWAPT, GWEB, GCSA, CISSP, AZ-500 or AWS Security Specialty would be beneficial but are not essential.

Who You'll Be Working With

You'll join a highly collaborative Security Engineering function comprising specialists across:

• Application Security
• Penetration Testing
• Red Teaming
• Cloud Security Engineering
• DevSecOps
• Secure Software Development
• Security Architecture
• Identity & Access Management

You'll build strong working relationships with architects, engineers, product managers and delivery teams across the organisation, helping to create secure solutions that work in the real world.

Why Join Us?

This is an opportunity to make a genuine impact within a modern technology environment where security is viewed as an enabler of innovation.

You'll have the autonomy to influence product direction, improve security maturity and work directly with teams delivering business-critical products and services.

If you're passionate about secure software development, enjoy working alongside engineers and want to help shape security outcomes that matter, we'd love to hear from you.