Head of Application Security

WeDo; United Kingdom; Remote; USD 120,000 - 160,000; Full time

Job summary

A UK-based FinTech company is seeking a Lead Application Security Engineer to enhance its robust application security framework. In this hands-on role, you'll be addressing vulnerabilities in live systems while shaping the AppSec strategy. This opportunity promises significant impact, visibility, and team-building as you lead security initiatives within a mature environment focused on innovation in credit services.

Qualifications

• Deep hands-on experience in application security with practical skills.
• Background in credit card and financial transaction systems.
• Understanding of modern application architectures (APIs, microservices, cloud platforms).

Responsibilities

• Identify vulnerabilities in applications related to authentication, payments, and sensitive data.
• Perform penetration testing and threat modeling.
• Work with developers to integrate security best practices.

Skills

Application Security

Penetration Testing

Vulnerability Management

Secure Coding

DevSecOps Practices

Job description

Title: Lead Application Security Engineer

Location: Fully Remote (UK-based)

Sector: FinTech / Digital Consumer Finance

We’re recruiting on behalf of a UK-based FinTech that’s simplifying how consumers engage with credit – offering digital credit cards and financial services built on cloud-native architecture and driven by data.

They are looking to hire a highly technical, hands-on Lead Application Security Engineer to take full ownership of the application security landscape – not from a policy or governance standpoint, but through deep, practical expertise in identifying and fixing vulnerabilities across live systems.

This role is perfect for a white hat hacker mindset – someone who thrives in proactively breaking applications, exposing flaws in logic, authentication, payment processing, or APIs, and using creativity (not just tooling) to harden applications from real-world threats.

What Makes This Role Stand Out?

• You’ll be hands-on: This is not a governance or compliance function. It’s about deep technical engagement with the codebase, systems, and application architecture.
• You’re walking into a mature environment: The company already has Secure SDLC and DevSecOps practices in place. This isn’t a ground-up build – it’s about stress-testing and strengthening what’s already built.
• You’ll have impact and visibility: Reporting to the CIO, with close collaboration with the Head of Information Security (compliance), you’ll shape the AppSec strategy while also getting into the code.
• You’ll build your own team: This role includes team growth – you’ll start as a leader and grow your own capability beneath you.

What You’ll Be Doing:

• Actively identifying vulnerabilities in applications, especially around authentication flows, payments, and sensitive data handling
• Thinking creatively and adversarially – “breaking the app” to protect it
• Performing penetration testing, threat modelling, and secure code reviews
• Working directly with developers to integrate security best practices into an already-operational DevSecOps pipeline
• Advising on product and architectural design from a security-first lens
• Contributing to a security culture that prioritises customer trust and system integrity

What We’re Looking For:

• Deep hands-on experience in application security – not just theory, but experience in secure coding, manual testing, and fixing complex vulnerabilities
• A proven background in credit cards, payments, or financial transaction systems
• Understanding of modern application architectures (APIs, microservices, cloud platforms – likely Azure)
• Familiarity with OWASP Top 10, SAST/DAST, and a variety of pen testing techniques
• A desire to build and lead a team, while remaining technical and practical day to day
• Right to work in the UK and ability to work remotely from within the UK

Recruitment Process:

• Initial call with Head of Engineering
• Second stage with CIO
• Final conversation and potentially a take-home exercise

If you're ready to be the attacker before the attacker is, and want to lead AppSec in an ambitious and growing FinTech, we’d love to hear from you.

Seniority level

• Seniority level

  Mid-Senior level

Employment type

• Employment type

  Full-time

Job function

• Job function

  Information Technology

• Industries

  Staffing and Recruiting

Referrals increase your chances of interviewing at WeDo by 2x

Sign in to set job alerts for “Application Security Engineer” roles.

United Kingdom $120,000.00-$160,000.00 1 month ago

Northern Ireland, United Kingdom 4 weeks ago

DevSecOps / Application Security Engineer

London, England, United Kingdom 1 day ago

Adderbury, England, United Kingdom 1 month ago

Principal Engineer - Application Security / DevSecOps - Remote

London, England, United Kingdom 1 day ago

QA Automation Engineer - C# / Linux / Mac / Windows / Remote

London, England, United Kingdom 4 days ago

Senior Fullstack Engineer - Ruby on Rails

Coming Soon : Enterprise Sales Representative - UK

Lead CRM Solution Architect - Microsoft Dynamics 365

We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.