Application Security Engineer - Hybrid, Secure DevOps

BUPA; City Of London; Hybrid; GBP 67,000 - 84,000; Full time

Benefits offered by this job

25 days holiday

Health insurance

Pension plan

Onsite gyms / discounts

Online discounts

Job summary

Bupa is seeking an Application Security Engineer to join a Hybrid team across Manchester, Staines, or London. You will design, deploy, and operate secure development tooling, aligning with GDPR, ISO 27001 and NIST standards while supporting multiple markets.

You'll embed security into CI/CD, manage security tooling in pipelines, and advise colleagues on best practices, with a focus on automation, risk reduction and secure product lifecycles.

Qualifications

• Experience designing, implementing, and operating secure development processes, incl. SCA, SAST, DAST.
• Strong knowledge of application security best practices and CI/CD integration.
• Experience with code and automation (Terraform, PowerShell, Python, REST APIs).
• Professional certifications such as CISSP, CISM or CISA desirable.
• Experience with regulatory frameworks ISO 27001, NIST, GDPR.

Responsibilities

• Design, configure, develop, integrate, deploy and maintain secure development technologies.
• Integrate Application Security tooling with development pipelines and enterprise architecture.
• Develop and embed application security into delivery pipelines.
• Implement product management to drive continuous control improvements via IaC, CI/CD and DevOps.
• Ensure compliance with GDPR, ISO 27001, and NIST standards and provide evidence/reports.

Skills

Secure SDLC

App security tooling

CI/CD security

SCA/SAST/DAST

Automation scripting

Terraform

PowerShell

Python

REST APIs

Regulatory standards

Education

CISSP/CISM/CISA (desirable)

Tools

Terraform

PowerShell

Python

MS Entra

Job description

Bupa is seeking an Application Security Engineer to join a Hybrid team across Manchester, Staines, or London. You will design, deploy, and operate secure development tooling, aligning with GDPR, ISO 27001 and NIST standards while supporting multiple markets.

You'll embed security into CI/CD, manage security tooling in pipelines, and advise colleagues on best practices, with a focus on automation, risk reduction and secure product lifecycles.