Application Security Engineer

Allwynuk; Watford; On-site; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Company Bonus Scheme

Matched pension contributions up to 8.

26 days annual leave + 2 Life Days

Single Private Health Cover

Private Medical

Income Protection

Flexible Benefits – EV Scheme, Will, D

Job summary

Allwyn UK is hiring an Application Security Engineer to ensure security of software applications through rigorous testing and validation across the SDLC. You will embed proactive security testing in development, identify vulnerabilities, and support remediation with dev teams.

You’ll integrate SAST/DAST/MAST/IAST tools in CI/CD, shape threat models, and deliver clear security reports to stakeholders. Collaboration and continuous learning are essential in this role.

Qualifications

• 3–5+ years of hands-on application security testing experience.
• Strong knowledge of SAST, DAST, MAST, and IAST tools and methods.
• Familiarity with secure SDLC and DevSecOps practices.
• Experience integrating application security testing into CI/CD pipelines.
• Good understanding of OWASP Top 10, ASVS, MASVS.
• Proficiency in at least one programming or scripting language (Python/JavaScript/C#).
• Strong analytical, problem-solving, and communication skills.
• Experience producing clear security reports and documentation.

Responsibilities

• Collaborate with development teams to create and maintain application threat models (STRIDE, DREAD).
• Identify and document application risks; propose countermeasures.
• Integrate application vulnerability scanning tools within CI/CD pipelines.
• Interpret vulnerability reports and prioritize remediation by risk.
• Promote awareness of common vulnerabilities and mitigation strategies (OWASP Top 10, ASVS, MASVS).
• Support teams in secure coding practices, including static analysis and code reviews.
• Plan, execute, and manage SAST, DAST, MAST, IAST testing.
• Embed security testing into CI/CD for automated validation.
• Simulate real-world attack scenarios to find weaknesses.
• Develop scripts and tooling to automate security testing.
• Produce actionable security reports for technical and non-technical audiences.
• Maintain testing methodologies and remediation guidance.

Skills

Application security testing

SAST/DAST/MAST/IAST

CI/CD security integration

Secure SDLC / DevSecOps

OWASP Top 10 / MASVS / ASVS

Python / JavaScript / C#

communication & documentation

Education

Bachelor’s degree in Software Engineering

CREST Web Application Tester (nice to have)

Tools

SonarCloud

Snyk

OWASP ZAP

Burp Suite

Tenable WAS

Job description

At the heart of everything we do is our vision to change lives every day, and our mission to grow The National Lottery responsibly and champion its impact.

We are Allwyn UK, part of the Allwyn Entertainment Group – a multi-national lottery operator with a market-leading presence acrossthe USA (Michigan and Illinois) andEurope, includingCzech Republic, Austria, Greece,Cyprusand Italy.

While the main contribution of The National Lottery to society is through the funds togood causes, at Allwynwe put our purpose and values at the heart of everything we do.Join us as we embark on a once-in-a-lifetime, largescale transformation journey by creating a National Lottery that delivers more money togood causes.

We’lltalk a bit more about us further down the page, but for now –let’stalk about the role and whowe’relooking for…

A bit about the role

The Application Security Engineeris responsible forensuring the security of software applications through rigorous testing and validation. This role is dedicated to embedding security testing throughout the software development lifecycle (SDLC),identifyingvulnerabilities, and supporting development teams in remediating security issues. The focus is on proactive, continuous security assessment of applications, both pre- and post-deployment, tomaintainthe highest standards of software security.

Whatyou’llbe doing

• Collaborate with development teams to create andmaintainapplication threat models (e.g., STRIDE, DREAD).

• Identifyand document application-specific risks; propose effective countermeasures.

• Integrate andoperateapplication vulnerability scanning tools (e.g.,Sonar Cloud,Snyk,OWASP ZAP, Burp Suite, Tenable WAS) within CI/CD pipelines.

• Interpret vulnerability reports, prioritise remediation based on risk, and track resolution with development teams.

• Promote awareness of common application vulnerabilities (e.g., SQL injection, XSS, CSRF) and mitigation strategies (OWASP Top 10, ASVS, MASVS).

• Support development teams in adopting secure coding standards, including static analysis tools, code reviews, and automated linting.

• Plan, execute, and manage Static, Dynamic,Mobile,and Interactive Application Security Testing (SAST, DAST,MAST,IAST).

• Embed security testing into CI/CD pipelines for continuous, automated validation.

• Simulate real-world attack scenarios toidentifyweaknesses in application logic and implementation.

• Develop andmaintainscripts, tools, and processes to automate application security testing.

• Produce clear, actionable security testing reports for technical and non-technical stakeholders.

• Maintain comprehensive documentation of testing methodologies, findings, and remediation guidance.

• Work closely with software engineers, QA, and product teams to embed security best practices.

• Deliver training and awareness sessions on application security testing techniques and secure development.

What experiencewe’relooking for

Must have:

• 3-5+ years of hands-on experience in application security testing

• Strong knowledge of SAST, DAST,MAST,and IAST tools and methodologies.

• Familiarity with secure SDLC andApplicationDevSecOpspractices.

• Experience integratingapplicationsecurity testing into CI/CD pipelines.

• Good understanding of common application vulnerabilities and mitigation strategies (OWASP Top 10, ASVS, MASVS).

• Proficiencyin at least one programming or scripting language (e.g., Python, JavaScript, C#).

• Strong analytical, problem-solving, and troubleshooting skills.

• Excellent communication and teamwork abilities.

• Experience in producing clear, concise technical documentation and security reports.

• Commitment to continuous learning and keeping up with evolving application security threats and technologies.

Nice to have:

• CRESTCertified Web Application Tester

• Bachelor’s degree inSoftwareEngineering

Key Measures of Success:

• Proactive identification and remediation of application vulnerabilities.

• Effective integration ofapplicationsecurity testing into development workflows.

• Demonstrated improvement in application security posture over time.

• Positive feedback from development teamsregardingsecurity testing support.

• Ability to communicate complex security concepts to technical and non-technical stakeholders

About us

At Allwyn, we are dedicated to changing lives and growing the National Lottery responsibly, championing its positive impact on people, places, and the planet.

• Innovation -We pride ourselves on it!We’reconstantly looking for new ways to excite our customers, bringing new products to market toenjoywhich is all supported by our responsible play values and making them accessible to all.

• Giving back –Did you know that playing the lottery generates around £30m a week for charities andgood causesin the UK? Our aim is to have doubled this number by the end of the first 10-year license.

• Sustainability –Our aim is to become a net zero national lottery. We have 2030 targets to decarbonise our operations and energy.We’vealready transitioned to renewable energy providers, made our London and Watford offices zero gas, and ensured our fleet consists of low-emission vehicles. In addition,we’reworking with our value chain partners to develop a net zero target date.

• Empowering every voice– We believe in creating a culture where everyone feels they belong, can be themselves, has access to opportunities and can thrive for the benefit of good causes.Our diverse teams are working hard to make all parts of The National Lottery inclusive – whether people play a game in a store or online,because when everyone can play, everyonewins..

An inclusive reward offering with wellbeing at the centre

At Allwyn, inclusion is built into how we care for our people. Our benefits and policies support colleaguesand their familiesat every stage of life and career. By prioritising wellbeing and belonging, we create a workplace where everyone feels valued, rewarded, and empowered to succeed.Our people are more than colleagues -they’rewinners, driving positive change and making a real difference in communities.

Benefits

• CompanyBonusScheme

• Matched pension contributions up to 8.5%

• 26 days annual leave + 2 Life Days (and bank holidays)

• Single Private Health Cover

• Complimentary Private Medical

• Income Protection

• Flexible Benefits – EV Scheme,Money Coach, Will Writing,Mortgage Advice,Dental and Eye Care Schemes.

• EnhancedFamily Leave (Maternity,Paternity, Adoption)

• WellnessAllowance£500

• Employee AssistanceProgramme

• Discounted Health Assessments

• Volunteering Days

• Matched Funding

We are a Disability Confident Leader which meanswe’vetaken proactive steps to ensure our workplace is accessible and inclusive for disabled and neurodivergent colleagues and candidates. As part of this we offer an interview to disabled applicants who meet the essential requirements of the job.

If you need anyassistanceor adjustments to this job description or in the application process, please contact a member of the talent team at [e-mail] we’llbe happy to help.