Embedded Application Security Engineer (12-Month Contract)

Spencer Rose Ltd; Easter Howgate; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

Spencer Rose Ltd in the United Kingdom is seeking an experienced Application Security Engineer for a 12-month fixed-term contract. You will be embedded in product delivery, working directly with engineers, architects and product teams to ensure security is considered from the earliest design conversations through to deployment and beyond.

You will review designs, run threat modeling, guide secure architecture across applications, APIs, cloud services and integrations, and help pipelines with

Qualifications

• Experience in application security, product security or secure software engineering.
• Strong understanding of common app and API security risks including auth, data protection and misconfig.
• Experience reviewing architectures and leading threat modelling workshops using STRIDE or similar.

Responsibilities

• Partner with product and engineering to understand systems, data flows and priorities.
• Review designs and facilitate threat modelling workshops to identify risks early.
• Provide guidance on secure architecture and development across apps, APIs, cloud services and integrations.
• Help embed security into development pipelines through tooling and secure-by-design practices.
• Investigate, triage and prioritize vulnerabilities and coordinate remediation and re-testing.

Skills

Threat modelling

Secure by Design

Application security testing

Vulnerability management

Security risk assessment

Secure software development practices

CI/CD security

Stakeholder management

Tools

SAST

Software composition analysis

Secrets detection

API security testing

Container scanning

CI/CD tooling

Job description

Spencer Rose Ltd in the United Kingdom is seeking an experienced Application Security Engineer for a 12-month fixed-term contract. You will be embedded in product delivery, working directly with engineers, architects and product teams to ensure security is considered from the earliest design conversations through to deployment and beyond.

You will review designs, run threat modeling, guide secure architecture across applications, APIs, cloud services and integrations, and help pipelines with