Application Security Engineer (12-Month Fixed Term Contract)

Spencer Rose Ltd; Easter Howgate; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

Spencer Rose Ltd in the United Kingdom is seeking an experienced Application Security Engineer for a 12-month fixed-term contract. You will be embedded in product delivery, working directly with engineers, architects and product teams to ensure security is considered from the earliest design conversations through to deployment and beyond.

You will review designs, run threat modeling, guide secure architecture across applications, APIs, cloud services and integrations, and help pipelines with

Qualifications

• Experience in application security, product security or secure software engineering.
• Strong understanding of common app and API security risks including auth, data protection and misconfig.
• Experience reviewing architectures and leading threat modelling workshops using STRIDE or similar.

Responsibilities

• Partner with product and engineering to understand systems, data flows and priorities.
• Review designs and facilitate threat modelling workshops to identify risks early.
• Provide guidance on secure architecture and development across apps, APIs, cloud services and integrations.
• Help embed security into development pipelines through tooling and secure-by-design practices.
• Investigate, triage and prioritize vulnerabilities and coordinate remediation and re-testing.

Skills

Threat modelling

Secure by Design

Application security testing

Vulnerability management

Security risk assessment

Secure software development practices

CI/CD security

Stakeholder management

Tools

SAST

Software composition analysis

Secrets detection

API security testing

Container scanning

CI/CD tooling

Job description

Application Security Engineer (12-Month Fixed Term Contract)

Help Build Security into Products That Matter

We're looking for an experienced Application Security Engineer to join our Security Engineering team on a 12-month fixed-term contract.

This isn't a role where security sits on the side-lines. You'll be Embedded in product delivery, working directly with engineers, architects and product teams to ensure security is considered from the earliest design conversations through to deployment and beyond. You'll combine technical expertise with practical problem-solving, helping teams build secure solutions without slowing innovation.

If you enjoy collaborating with developers, influencing technical decisions, and turning security challenges into workable solutions, we'd love to hear from you.

What You'll Be Doing

As the dedicated Application Security Engineer for a portfolio of customer-facing and digital products, you'll be trusted to:

• Partner with product and engineering teams to understand systems, data flows, users and business priorities.
• Review solution designs and facilitate threat modelling workshops, helping teams identify risks before they become problems.
• Provide practical, real-world guidance on secure architecture and development across applications, APIs, cloud services and integrations.
• Help teams embed security into their development pipelines through automation, tooling and security-by-design practices.
• Investigate, triage and prioritise vulnerabilities, translating technical findings into clear actions for development teams.
• Coordinate penetration testing activities and support teams through remediation and re-testing.
• Assess the security of SaaS platforms, third-party technologies and external integrations.
• Work closely with Security Operations, Identity & Access Management and Cloud Security colleagues where risks cross functional boundaries.
• Represent security interests within technical governance forums, providing balanced advice and escalating significant risks when required.
• Contribute to evolving security standards, secure development practices and application security maturity across the organisation.
• Maintain clear records of decisions, risks and recommendations, ensuring a smooth handover at the end of the contract.

About You

You're someone who enjoys solving problems, building relationships and making security relevant and actionable.

You understand that the best security professionals don't just identify risks, they help teams address them in practical ways.

You'll have experience across areas such as:

• Secure by Design principles
• Threat modelling
• Application security testing
• Vulnerability management
• Security risk assessment
• Secure software development practices

Experience with technologies such as Java/Spring Boot, React, Node.js, Snowflake, Salesforce, Kubernetes/OpenShift, Snyk or Wiz would be beneficial, but we're equally interested in candidates who have gained relevant experience across different technology stacks and tooling.

What We're Looking For

You’ll likely have:

• Experience working in Application Security, Product Security or Secure Software Engineering.
• A strong understanding of common application and API security risks, including authentication, authorisation, data protection and security misconfiguration.
• Experience reviewing architectures and facilitating threat modelling workshops using STRIDE or similar methodologies.
• Hands-on experience with security testing practices and tools, including SAST, software composition analysis, secrets detection, API security testing and infrastructure or container scanning.
• The ability to assess vulnerabilities through both a technical and business lens, helping teams focus on what matters most.
• Familiarity with modern engineering environments, including cloud platforms, CI/CD pipelines and containerised applications.
• Strong communication and stakeholder management skills, with the confidence to challenge constructively and influence decision-making at all levels.

Who You’ll Be Working With

You’ll be joining a collaborative and supportive Security Engineering function made up of specialists in:

• Application Security
• Penetration Testing
• Red Teaming
• Cloud Security Engineering
• Secure SDLC
• DevSecOps and CI/CD Security
• Software Development

You’ll also build strong relationships with architects, engineers, product managers and delivery teams across the business, helping create security solutions that work in the real world.

Why Join Us?

This is an opportunity to make a genuine impact. You'll have the autonomy to shape security outcomes, influence product decisions and work with teams that value security as an enabler rather than a blocker.

If you're passionate about secure development, enjoy working closely with engineering teams and want to help build resilient products in a modern technology environment, we'd love to hear from you.