Application Security Engineer / DevSecOps Specialist

Core-Asset-Consulting; Newcastle upon Tyne; On-site; GBP 65,000 - 90,000; Full time

Job summary

Core-Asset-Consulting is seeking an Application Security Engineer to embed security into the software development life cycle in Newcastle upon Tyne. You will act as a subject-matter expert in application and cloud security, guiding secure design, vulnerability remediation, and secure coding practices within agile teams.

The role focuses on integrating security into CI/CD pipelines, conducting secure design reviews, and underpinning DevSecOps maturity across projects in a UK-based environment.

Qualifications

• Experience securing applications in cloud environments, ideally Azure.
• Strong understanding of OWASP vulnerabilities.
• Software development experience ideally with C# / .NET.
• Knowledge of CI/CD pipelines and working with Azure DevOps.
• Experience with SAST, DAST and software composition analysis tools.
• Understanding of authentication, including OAuth2 and OpenID Connect.
• Experience managing and remediating vulnerabilities.
• Strong analytical and communication skills.
• Strong technical aptitude across application and cloud security.
• Ability to work effectively in agile environments.

Responsibilities

• Embed security controls within the software development life cycle.
• Perform secure design reviews for applications and APIs.
• Conduct SAST, DAST and software composition analysis.
• Support remediation of vulnerabilities with development teams.
• Integrate security tooling into CI/CD pipelines.
• Define secure coding standards aligned to OWASP best practice.
• Conduct threat modelling for critical systems.
• Ensure secure cloud configurations.
• Develop detections for application security events and support incident response for application-related threats.
• Maintain the application risk register and vulnerability tracking.
• Provide guidance and training to developers on secure coding.
• Support security improvement and DevSecOps maturity initiatives.

Skills

Azure security

OWASP vulnerabilities

C# / .NET

CI/CD pipelines

SAST/DAST/SCA tools

OAuth2/OpenID Connect

Vulnerability remediation

Analytical communication

Application & cloud security

Agile environments

Tools

Azure DevOps

SAST tools

DAST tools

SCA tools

Job description

Application Security Engineer / DevSecOps Specialist (16646) Newcastle upon Tyne, England

Job Description:

Our client is looking to appoint an Application Security Engineer to embed security into the software development life cycle. You will act as a subject-matter expert in application and cloud security, providing assurance, secure design guidance and vulnerability remediation support, and ensuring that secure coding, monitoring and vulnerability management practices are consistently applied. This role is well suited to someone already working in that space or a Developer that is looking for a move into being more security focusedand looking at how security is embedded with the SDLC.

Skills/Experience:

• Experience securing applications in cloud environments, ideally Azure
• Strong understanding of OWASP vulnerabilities.
• Software development experience ideally with C# / .NET.
• Knowledge of CI/CD pipelines and working with Azure Devops
• Experience with SAST, DAST and software composition analysis tools.
• Understanding of authentication, including OAuth2 and OpenID Connect.
• Experience managing and remediating vulnerabilities.
• Strong analytical and communication skills.
• Strong technical aptitude across application and cloud security.
• Ability to work effectively in agile environments.

Core Responsibilities:

• Embed security controls within the software development life cycle.
• Perform secure design reviews for applications and APIs.
• Conduct SAST, DAST and software composition analysis.
• Support remediation of vulnerabilities with development teams.
• Integrate security tooling into CI/CD pipelines.
• Define secure coding standards aligned to OWASP best practice.
• Conduct threat modelling for critical systems.
• Ensure secure cloud configurations.
• Develop detection'sfor application security events and support incident response for application-related threats.
• Maintain the application risk register and vulnerability tracking.
• Provide guidance and training to developers on secure coding.
• Support security improvement and DevSecOps maturity initiatives.