Application Security Specialist (12 month fixed term contract)

Motability Operations Ltd; City of Edinburgh; Híbrido; GBP 60.000 - 90.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Annual discretionary bonus

Pension 15% non-contributory

Life assurance 4x salary

Employee discount scheme

Cycle to work scheme

Private medical insurance

Descripción de la vacante

Motability Operations seeks a hands-on Application Security Engineer to cover a 12-month period across Customer B2C and Connected Mobility domains. You will work with product teams to reduce security risk from design through release, ensuring secure development practices and governance across CI/CD pipelines.

You will be the day-to-day security contact, guiding teams on secure design, threat modelling and remediation, coordinating pen-testing, and driving improvements with Security Operations

Formación

• Experience in an application security, product security or secure software engineering role.
• Practical understanding of common web application and API security risks, including authentication, authorisation, input handling, data protection and security misconfiguration.
• Experience reviewing application designs or data flows and facilitating threat modelling, using STRIDE or a comparable approach.
• Experience using or interpreting results from application security testing, such as SAST, software composition analysis, API testing, secrets detection or infrastructure and container configuration scanning.
• Ability to triage findings based on exploitability, impact and business context, and to explain remediation clearly to developers.
• Familiarity with modern software delivery and cloud environments, such as CI/CD, AWS, containers and orchestration platforms.
• Strong communication skills and the judgement to distinguish advice, required controls and risks that need escalation.

Responsabilidades

• Engage with product and delivery teams early to understand systems, data, users and business context.
• Review solution architectures and data flows; facilitate threat modelling and turn findings into clear, prioritised security requirements.
• Provide practical advice on secure design and implementation for applications, APIs, cloud services and integrations.
• Help teams use and improve automated security checks in development and CI/CD workflows, including code, dependency and configuration checks where relevant.
• Triage findings based on risk and context, explain remediation options, and work with engineering teams to verify fixes.
• Coordinate penetration testing and track material findings through remediation and retesting.
• Assess the security of SaaS platforms, external APIs and OEM integrations in collaboration with the relevant teams.
• Work with Security Operations, IAM and Cloud Security to coordinate controls, monitoring and response were application risks cross team boundaries.
• Represent project security positions at the Cyber Security Technical Working Group, working with Solution Architects and escalating decisions that exceed your delegated authority.
• Contribute to improvements in application security standards, secure development practices and the product maturity security strategy.
• Maintain clear records of advice, decisions, findings and exceptions, and provide a practical handover at the end of the fixed-term period.

Conocimientos

Threat modelling

Secure by design

App security testing

Vuln management

Security risk assessment

CI/CD security

AWS / Cloud

Herramientas

Java/Spring Boot

React/Node.js

Snowflake

Salesforce

Kubernetes/OpenShift

Snyk

Wiz

Descripción del empleo

About The Role

Reporting to the Security Engineering Team Lead, you will provide hands on application security engineering for the Customer B2C and Connected Mobility domains during a 12 month cover period. You will work with product teams, engineers and architects to identify and reduce security risk throughout design, development, testing and release.

About The Role

Reporting to the Security Engineering Team Lead, you will provide hands on application security engineering for the Customer B2C and Connected Mobility domains during a 12 month cover period. You will work with product teams, engineers and architects to identify and reduce security risk throughout design, development, testing and release.

You will be the day-to-day application security contact for these domains, working within the wider Security Engineering function and escalating risks to the appropriate security and business owners. You will help teams build and improve security controls in their delivery processes and reduce overall identified vulnerabilities in this area.

• Engage with product and delivery teams early to understand systems, data, users and business context.
• Review solution architectures and data flows; facilitate threat modelling and turn findings into clear, prioritised security requirements.
• Provide practical advice on secure design and implementation for applications, APIs, cloud services and integrations.
• Help teams use and improve automated security checks in development and CI/CD workflows, including code, dependency and configuration checks where relevant.
• Triage findings based on risk and context, explain remediation options, and work with engineering teams to verify fixes.
• Coordinate penetration testing and track material findings through remediation and retesting.
• Assess the security of SaaS platforms, external APIs and OEM integrations in collaboration with the relevant teams.
• Work with Security Operations, IAM and Cloud Security to coordinate controls, monitoring and response were application risks cross team boundaries.
• Represent project security positions at the Cyber Security Technical Working Group, working with Solution Architects and escalating decisions that exceed your delegated authority.
• Contribute to improvements in application security standards, secure development practices and the product maturity security strategy.
• Maintain clear records of advice, decisions, findings and exceptions, and provide a practical handover at the end of the fixed-term period.

About You

You’re an experienced Application Security professional with a strong understanding of Secure by Design, threat modelling, application security testing, vulnerability management and security risk assessment.

Experience with Java/Spring Boot, React/Node.js, Snowflake, Salesforce, Kubernetes/OpenShift, Snyk or Wiz would be useful. Equivalent experience with other languages, cloud platforms and security tools is welcome.

Minimum criteria

You’ll need all of these.

• Experience in an application security, product security or secure software engineering role.
• Practical understanding of common web application and API security risks, including authentication, authorisation, input handling, data protection and security misconfiguration.
• Experience reviewing application designs or data flows and facilitating threat modelling, using STRIDE or a comparable approach.
• Experience using or interpreting results from application security testing, such as SAST, software composition analysis, API testing, secrets detection or infrastructure and container configuration scanning.
• Ability to triage findings based on exploitability, impact and business context, and to explain remediation clearly to developers.
• Familiarity with modern software delivery and cloud environments, such as CI/CD, AWS, containers and orchestration platforms.
• Strong communication skills and the judgement to distinguish advice, required controls and risks that need escalation.

About The Company

Motability Operations is a unique organisation, virtually one of a kind. We combine a strong sense of purpose with a real commercial edge to ensure we provide the best possible worry-free mobility solutions to over 800,000 customers and their families across the UK. Customers exchange their higher rate mobility allowance to lease a range of affordable vehicles (cars, wheelchair accessible vehicles, scooters, and powered wheelchairs) with insurance, maintenance and breakdown assistance included. We are the largest car fleet operator in the UK (purchasing around 10% of all the new cars sold in the UK) and work with a network of around 5,000 car dealers and all the major manufacturers. We pride ourselves on delivering outstanding customer service, achieving an independently verified customer satisfaction rating of 9.8 out of 10.

Our Values Are At The Heart Of Everything We Do. They Represent Ambition, And We Look For Our People To Live And Breathe Them Every Day

• We find solutions
• We drive change
• We care

We operate hybrid working across the organisation where we split our time between working on-site at our offices, and at home, remotely within the UK. We believe hybrid working achieves a good work/life balance for our colleagues, allowing us to connect with each other, collaborate on important work, and perform together to deliver for our customers. It allows us to have the flexibility to work remotely up to 2-days per week whilst also using the great office spaces we have available.

As a Motability Operations Team Member, You Can Expect

• An annual discretionary bonus
• 15% non-contributory pension (9% non-contributory pension during probation period)
• Life assurance at 4 times your basic salary to give you peace of mind that your loved ones will receive some financial help
• Employee Discount Scheme with a huge number of retailers and an app to save on the go
• Discounted Electric/Hybrid Car Salary Sacrifice Scheme
• Access to the Cycle to Work Scheme (we have showers, changing rooms and secure bike sheds on site)

As well as financial benefits, our staff's health and well-being are very important to us, so we also offer:

• 28 days annual leave with option to purchase and sell days
• Funded Private Medical Insurance cover
• Critical illness insurance
• Free access to healthcare apps, such as Peppy, Unmind, Aviva Digital GP
• Funded health screening for over 50s
• 1 day per year to volunteer – Staff can support a local charity or do a sponsored event whilst being paid for it
• Access to our fully accessible company allotment – Where we grow our own produce for local charitable organisations
• Access to Prayer room and quiet spaces whilst working in the office

We also understand that not everyone is the same so offer several voluntary benefits that you can select outside the core package, these include;

• Dental Insurance
• Health and cancer screenings for you and your partner
• Discounted gym memberships
• Charitable giving

At Motability Operations, we believe in building a diverse workforce, where our people are empowered to attend work as their true selves, and we encourage people from all backgrounds to apply. We want to sustain a culture that nurtures, where employees are free to flourish and where they’re rewarded equally, regardless of race, nationality or ethnic origin, sexual orientation, age, disability, or gender.

We pride ourselves on being an inclusive employer and as such, all our offices provide first rate disability access. With our hybrid working environment, we do our best to accommodate part-time and flexible working requests where possible, building on our culture of trust, empowerment, and flexibility.