Application Security Engineer - Secure-by-Design Advocate

Spencer Rose Ltd; City of Edinburgh; On-site; GBP 77,000 - 94,000; Full time

Job summary

Spencer Rose Ltd in Edinburgh is seeking an experienced Application Security Engineer to join our Security Engineering team on a 12-month fixed-term contract. This hands-on role embeds with product and engineering teams to build security into products from the outset.

You'll work with software engineers, architects and product leaders to identify risks early, influence technical decisions and enable secure delivery without slowing innovation.

Qualifications

• ,

Responsibilities

• Partner with engineering, architecture and product teams to understand systems, data flows, business priorities and security requirements.
• Lead threat modelling activities and security design reviews to identify risks during solution design and development.
• Provide pragmatic guidance on secure application architecture, secure coding practices and security controls across applications, APIs, cloud services and integrations.
• Support the adoption of Secure by Design principles throughout the software development lifecycle.
• Collaborate with development teams to embed security tooling and automated controls within CI/CD pipelines.
• Assess and prioritise security vulnerabilities, helping teams understand risk and implement effective remediation plans.
• Coordinate penetration testing activities and support remediation, validation and risk management processes.
• Perform security assessments of SaaS solutions, third–party vendors and external integrations.
• Work closely with Cloud Security, Identity & Access Management and Security Operations teams to manage cross–functional security risks.
• Represent application security interests within project and governance forums, providing balanced, risk–based security advice.
• Contribute to the continuous improvement of application security standards, frameworks and operational processes.
• Maintain clear documentation of security assessments, risks, decisions and recommendations.

Skills

Application Security

Product Security

Secure by Design

Threat Modelling

Security Architecture Reviews

Vulnerability Management

SSDLC

DevSecOps & CI/CD

Security Risk Assessment

App & API Security Testing

Tools

Java

Spring Boot

React

Node.js

Kubernetes

OpenShift

Snyk

GitHub Advanced Security

Azure

AWS

Snowflake

Salesforce

Job description

Spencer Rose Ltd in Edinburgh is seeking an experienced Application Security Engineer to join our Security Engineering team on a 12-month fixed-term contract. This hands-on role embeds with product and engineering teams to build security into products from the outset.

You'll work with software engineers, architects and product leaders to identify risks early, influence technical decisions and enable secure delivery without slowing innovation.