Application Security Engineer

Dev/Null Security; Sheffield; Remote; GBP 65,000 - 95,000; Full time

Job summary

Dev/Null Security, a UK-based cybersecurity consultancy, seeks an Application Security Engineer to lead end-to-end design and publish architecture patterns. You will collaborate with an enterprise architect and present to design authorities, ensuring solutions meet security standards across cloud-native and containerized environments.

The role emphasizes securing modern architectures, integrating AST/ SCA pipelines, and advising on risk-based security policies for code, dependencies, and build

Qualifications

• Significant application security experience across modern architectures and tooling.
• Experience with secure SDLC, threat modelling and policy design.
• Ability to architect and integrate AST/ SCA pipelines within CI/CD.

Responsibilities

• Provide assurance and oversight of security design for solutions.
• Align designs to reference architectures and enterprise standards.
• Consult on transformative security programmes and risk controls.
• Collaborate with engineers to remediate vulnerabilities and guide secure coding.
• Present designs to design authorities and senior stakeholders.

Skills

AppSec expertise

CI/CD security

Threat modelling

SAST/DAST/IAST

SBOM & vulnerability mgmt

Cloud-native

Kubernetes security

Security pipelines

Education

Bachelor or Master in cybersecurity/CS

CISSP/CISM or equivalent

SABSA or TOGAF (preferred)

Tools

Checkmarx

Invicti

Snyk

BlackDuck

Tenable

GitHub Actions

GitLab

Jenkins

Azure DevOps

Job description

Dev/Null Security is a UK-based cybersecurity consultancy specialising in security architecture, engineering, and operational support, helping enterprises protect high-value systems from advanced threats through strategy, consulting, managed services, and privileged access management.

We are seeking a Application Security Engineer to manage end-to-end solution design and be responsible for delivering design documents in line with functional and non-functional business requirements, strategies, principles, standards, and patterns. Alongside the creation of high-level designs, you will be required to publish new architecture patterns, key decisions, design deviations, and technical risks and issues where appropriate.

You will work with stakeholders including the relevant enterprise architect to ensure design decisions in delivery align to strategic direction. You should be comfortable presenting and sharing solutions at design authorities and to senior stakeholders.

Requirements

Cybersecurity Expertise:

Significant experience and proven technical depth within application security, such as;

• Hands-on experience securing modern application architectures (microservices, cloud-native, containerized environments).
• Knowledge of SCA tools and methodologies (e.g., dependency analysis, open-source license compliance, vulnerability triage, supply-chain risk management).
• Deep experience implementing and optimising AST capabilities, including SAST, DAST, IAST,MAST and container/K8s security scanning.
• Demonstrated success designing and integrating security testing pipelines within CI/CD environments (GitHub Actions, GitLab, Jenkins, Azure DevOps, etc.).
• Strong background in threat modelling, secure SDLC design, and establishing risk-based security policies for code, dependencies, and build systems.
• Ability to evaluate, select, and architect AppSec technologies, including enterprise SCA/AST platforms, SBOM solutions, and vulnerability management workflows.
• Experience collaborating with engineering teams to prioritize and remediate vulnerabilities, provide secure coding guidance, and enable developer-centric security practices.
• Familiarity with industry frameworks and standards (OWASP SAMM, ASVS, CSA, NIST SSDF, supply-chain security frameworks such as SLSA).
• Experience across vulnerability and exposure management including detection, analysis, management and resolution activities.

Experience within network security, such as;

• Segmentation and Micro-Segmentation and its effects on vulnerability scanning.
• Defining and enforcing policies for secure network operations and appropriate access for vulnerability scanning.
• Establishing appropriate logging for the monitoring and analysis of network traffic to detect and respond to threats.
• Broad background across information technology with the ability to communicate clearly with non-security technical SMEs at a comfortable level.
• Experience and understanding of both the roles and interlock between enterprise & solution architecture.
• Experience in both operational and transformation cybersecurity roles or a clear working understanding of both perspectives.
• Experience working in large-scale IT transformation programmes.
• Ability to manage separation of control from technical design authority responsibilities - represent Cyber Services at technical and security design authorities to ensure that solutions are secure.
• Experience ensuring compliance with security controls to identify control gaps, develop remediation plans and determine residual risk across both local and national programmes.

Qualifications & Certifications:

• Bachelors or master’s degree in cybersecurity, computer science, software engineering, or related field preferred.
• CISSP/CISM certification or other broad cybersecurity industry-recognised certificate preferred.
• SABSA or TOGAF certified preferred.

Platform & Technology:

• Experience with Checkmarx, Invicti, Snyk, BlackDuck, Tenable, or other related Application Security Testing products .
• BizzDesign, Archi, or generic UML visualisation experience for high-level designs.
• High proficiency and expertise in Jira for project & tasks management.
• Working proficiency in Confluence for documentation.

Accountabilities and Responsibilities:

• Provide assurance, support and oversight of solutions designs and support the engineering teams in delivering and executing strategic technology deployments.
• Ensure solution designs align to published reference architecture.
• Provide technical expertise & consultation to transformative programmes of work within their security domain.
• Influence business and technology executives to help them align their initiatives with standardised offerings whilst also engaging with them to understand their business requirements, threats and risks.
• Clear understanding of both the motivations of the business and technical security.
• Promote strong documentation and clerkship.

Working at DevNull Security

Whilst DevNull Security is a remote-first company, our consulting team may be required to travel to client sites up to 3 times per week, depending on project and customer needs.

We believe that a career in cybersecurity should be accessible to everyone. We actively welcome applicants from all walks of life, regardless of race, ethnicity, gender identity, age, sexual orientation, disability, neurodiversity, socioeconomic background, or any other aspect of identity.

As a growing company, we’re committed to fostering an inclusive, equitable, and accessible hiring experience. We proactively offer adjustments during application and assessment - tell us what you need.