Application Security Engineer: Build Secure Cloud & APIs

Centrica plc; United Kingdom; Hybrid; GBP 75,000 - 110,000; Full time

Benefits offered by this job

Market salary

15% Employee Energy Allowance

Pension plan

Company healthcare plan

25 days holiday + extra days

Job summary

Centrica plc is seeking a skilled Application Security Specialist to join our UK-based hybrid team. You will collaborate with DevOps and engineering to weave security into the software development lifecycle, review SAST/DAST/ SCA results, and drive remediation with a strong focus on API security, cloud-native architectures, and container security.

Leverage your expertise across OWASP Top 10, threat modelling and security automation in Python/JavaScript, with exposure to Azure DevOps and GitHub

Qualifications

• Strong hands-on experience in application security and secure software development lifecycle.
• Experience with OWASP Top 10 and common application vulnerabilities.
• Proficiency in Python or JavaScript with security automation experience.
• Familiarity with cloud platforms (AWS/Azure) and modern application architectures.
• Knowledge of container security, API security, OAuth2.0, OIDC and SAML.

Responsibilities

• Collaborate with DevOps and engineering to weave security into the SDLC.
• Review SAST, DAST and SCA outputs and drive remediation to closure.
• Lead or contribute to the Security Champions programme and support CSIRT/GSOC teams.
• Provide on-demand app security guidance and improve security tooling and processes.

Skills

Application security

Secure SDLC

OWASP Top10

Python

JavaScript

Cloud platforms

AWS

Azure

SAP

Container security

API security

CI/CD security integration

Azure DevOps

GitHub Actions

SAST

DAST

SCA

SBOM tooling

Trivy

Terraform

Bicep

Ansible

Threat modelling

Tools

CycloneDX

Trivy

Terraform

Bicep

Ansible

Job description

Centrica plc is seeking a skilled Application Security Specialist to join our UK-based hybrid team. You will collaborate with DevOps and engineering to weave security into the software development lifecycle, review SAST/DAST/ SCA results, and drive remediation with a strong focus on API security, cloud-native architectures, and container security.

Leverage your expertise across OWASP Top 10, threat modelling and security automation in Python/JavaScript, with exposure to Azure DevOps and GitHub