Application Security Specialist (12 month fixed term contract)

Motability Operations Ltd; City of Edinburgh; On-site; GBP 65,000 - 85,000; Full time

Job summary

Motability Operations Ltd is seeking a hands-on application security engineer to support the Customer B2C and Connected Mobility domains during a 12-month cover period. You will work with product teams, engineers and architects to identify and reduce security risk throughout design, development, testing and release.

You will be the day-to-day application security contact for these domains, helping teams build and improve security controls, coordinate testing and ensure secure development

Responsibilities

• Engage with product and delivery teams early to understand systems, data, users and business context.
• Review solution architectures and data flows; facilitate threat modelling and turn findings into clear, prioritised security requirements.
• Provide practical advice on secure design and implementation for applications, APIs, cloud services and integrations.
• Help teams use and improve automated security checks in development and CI/CD workflows, including code, dependency and configuration checks where relevant.
• Triage findings based on risk and context, explain remediation options, and work with engineering teams to verify fixes.
• Coordinate penetration testing and track material findings through remediation and retesting.
• Assess the security of SaaS platforms, external APIs and OEM integrations in collaboration with the relevant teams.
• Work with Security Operations, IAM and Cloud Security to coordinate controls, monitoring and response where application risks cross team boundaries.
• Represent project security positions at the Cyber Security Technical Working Group, working with Solution Architects and escalating decisions that exceed your delegated authority.
• Contribute to improvements in application security standards, secure development practices and the product maturity security strategy.
• Maintain clear records of advice, decisions, findings and exceptions, and provide a practical handover at the end of the fixed-term period.

Job description

Reporting to the Security Engineering Team Lead, you will provide hands on application security engineering for the Customer B2C and Connected Mobility domains during a 12 month cover period. You will work with product teams, engineers and architects to identify and reduce security risk throughout design, development, testing and release.

You will be the day-to-day application security contact for these domains, working within the wider Security Engineering function and escalating risks to the appropriate security and business owners. You will help teams build and improve security controls in their delivery processes and reduce overall identified vulnerabilities in this area.

• Engage with product and delivery teams early to understand systems, data, users and business context.
• Review solution architectures and data flows; facilitate threat modelling and turn findings into clear, prioritised security requirements.
• Provide practical advice on secure design and implementation for applications, APIs, cloud services and integrations.
• Help teams use and improve automated security checks in development and CI/CD workflows, including code, dependency and configuration checks where relevant.
• Triage findings based on risk and context, explain remediation options, and work with engineering teams to verify fixes.
• Coordinate penetration testing and track material findings through remediation and retesting.
• Assess the security of SaaS platforms, external APIs and OEM integrations in collaboration with the relevant teams.
• Work with Security Operations, IAM and Cloud Security to coordinate controls, monitoring and response were application risks cross team boundaries.
• Represent project security positions at the Cyber Security Technical Working Group, working with Solution Architects and escalating decisions that exceed your delegated authority.
• Contribute to improvements in application security standards, secure development practices and the product maturity security strategy.
• Maintain clear records of advice, decisions, findings and exceptions, and provide a practical handover at the end of the fixed-term period.