Application Security Engineer

Oliver James Group; Manchester; On-site; GBP 36,000 - 60,000; Part time

Job summary

Oliver James Group is seeking an Application Security Engineer in Manchester, working on-site three days per week. You will shield software applications from cyber threats by embedding security across the development lifecycle and collaborating with development and security teams.

Responsibilities include AI-specific security testing, SAST/DAST, vulnerability remediation, and risk assessments, with a strong emphasis on staying ahead of emerging threats and ensuring secure coding practices across

Qualifications

• 1+ year in an Application/Security Engineer role.
• Experience with OWASP Top 10, SAST/DAST, CI/CD pipelines (Azure DevOps or GitHub).
• Strong communication and collaboration with cross-functional teams.

Responsibilities

• Define and implement security testing strategies for AI solutions using grey box and black box methods.
• Conduct SAST, dependency scanning, secrets scanning, and configuration reviews.
• Perform DAST, API fuzzing, authentication testing, and rate-limit testing.
• Execute AI-specific security tests for prompt injection, jailbreaking resistance, and leakage checks.
• Assess risks of new/existing applications and identify vulnerabilities and gaps.
• Interpret findings and verify fixes in code before production deployment.
• Collaborate with data engineering teams to enforce secure coding practices.
• Stay updated on threats and trends to improve risk assessments.
• Provide guidance for incident response related to application security.
• Conduct quarterly application security reviews and maintain incident records.

Job description

Application Security Engineer - Manchester (3 days per week onsite)

As an Application Security Engineer the focus of your role is to safeguard software applications from cyber threats by embedding security into every phase of the development lifecycle. You will bridge the gap between development and security teams, proactively identifying and mitigating vulnerabilities before software reaches production.

Requirements

• 1+ year in an Application/Security Engineer role (ideally in a fast-paced sales or professional services-based organisation). (AppSec / DevSecOps)
• Key Technical Disciplines: Microsoft Azure, Programming Proficiency (JavaScript, Python, MS SQL, C#), Vulnerability Scanning, Penetration Testing, Continuous Integration and Continuous Deployment Pipelines (Azure DevOps or GitHub), OWASP Top 10, Static and Dynamic Application Security Testing, SQL Injection.

Personality

• A very strong communicator and proactive team player (friendly, credible, articulate, and proactive) that can work with an ambitious sales force and stakeholders of all levels.

Responsibilities

• Define and implement security testing strategies for AI solutions, utilising both grey box and black box methodologies.
• Grey Box Testing: Conduct Static Application Security Testing (SAST), dependency scanning, secrets scanning, and configuration reviews.
• Black Box Testing: Perform Dynamic Application Security Testing (DAST), API fuzzing, authentication testing, and rate-limit tests.
• AI-Specific Security Tests: Execute prompt injection checks, jailbreaking resistance assessments, tool misuse evaluations, and leakage tests tailored for AI applications.
• Conduct thorough risk assessments of new and existing applications, identifying vulnerabilities and security gaps.
• Analyse and interpret security assessment findings, completing remediation efforts in code and verify fixes prior to production deployment.
• Collaborate with data engineering teams to implement security best practices and ensure secure coding standards.
• Stay current with emerging threats, vulnerabilities, and industry trends, integrating this knowledge into risk assessment processes.
• Provide technical guidance and support for incident response efforts related to application security incidents.
• Conduct quarterly application security reviews to evaluate and validate the effectiveness of security controls.
• Updating the ticket management system to maintain detailed record of incidents/requests.
• Security first mentality. Push cyber security standards within the IT team and to the wider group.
• Maintaining legacy software applications with bug fixes and critical security updates.