Cloud-Native App Security Engineer (DevSecOps)

Centrica; Windsor; Hybrid; GBP 90,000 - 120,000; Full time

Benefits offered by this job

Employee Energy Allowance

Company pension

Healthcare plan

25 days holiday

Job summary

Centrica is a family of brands energising a greener, fairer future and driving secure software delivery across multi-cloud environments. We are seeking an experienced Application Security Engineer to embed security in the development process, focusing on AWS, Azure DevOps and modern DevSecOps tooling.

Location: UK-based hybrid role with occasional travel to site. You will collaborate with engineering, platform and security teams to reduce risk, define standards, and enable secure, automated

Qualifications

• Strong hands-on experience in application security.
• Proficiency in Python or JavaScript with security automation experience.
• Experience across cloud platforms such as AWS and Azure.
• Solid understanding of secure SDLC, OAuth2/OIDC/SAML and API security.
• CI/CD security integration in DevOps environments, including Azure DevOps and GitHub Actions.
• Desirable certifications: GWAPT, GWEB, OSCP or AWS Security Specialty.

Responsibilities

• Weave security best practices into the software development lifecycle with DevOps and engineering teams.
• Provide guidance on secure design, implementation and architecture (API security, microservices, cloud-native).
• Carry out ongoing manual security assessments and coordinate third-party engagements as needed.
• Review SAST/DAST/SCA outputs; drive remediation to closure with clear ownership.
• Provide on-demand application security support and drive tooling/process improvements.
• Lead or contribute to the Security Champions programme and collaborate with GSOC/CSIRT.

Skills

Application security

OWASP Top 10

Python

JavaScript

AWS

Azure

DevSecOps

CI/CD security

Security automation

Security Champions

Tools

SAST

DAST

SCA

CycloneDX

Trivy

Terraform

Bicep

Ansible

Job description

Centrica is a family of brands energising a greener, fairer future and driving secure software delivery across multi-cloud environments. We are seeking an experienced Application Security Engineer to embed security in the development process, focusing on AWS, Azure DevOps and modern DevSecOps tooling.

Location: UK-based hybrid role with occasional travel to site. You will collaborate with engineering, platform and security teams to reduce risk, define standards, and enable secure, automated