Hybrid Application Security Engineer: Secure Code & PenTesting

Barclay Simpson; Greater London, Manchester, Glasgow; Hybrid; GBP 72,000 - 98,000; Full time

Job summary

Barclay Simpson is partnering with a leading UK financial services organisation to hire an Application Security Engineer. You will focus on secure code reviews, SAST/DAST, vulnerability assessments and embedding security throughout the CI/CD lifecycle.

The role requires experience with OWASP Top 10, Veracode, DevSecOps, and cloud security across Azure/AWS, plus Kali Linux for manual testing. Hybrid work in London, Manchester or Glasgow with in-office presence ~1 day per week.

Qualifications

• Proven experience in application security across CI/CD pipelines.
• Hands-on with OWASP Top 10 and security scanning tools such as Veracode.
• Experience with threat modelling and secure design practices.

Responsibilities

• Perform secure code reviews and SAST/DAST to identify and remediate security flaws.
• Embed security principles into the CI/CD pipeline and DevSecOps practices.
• Lead vulnerability assessments and coordinate remediation with engineering teams.
• Conduct pre-release manual penetration testing where applicable.
• Perform threat modelling and security design reviews for new features.

Skills

Secure code reviews

SAST/DAST

Vulnerability assessments

Threat modelling

PenTesting

OWASP Top 10

DevSecOps

CI/CD security

Cloud security

Azure

AWS

Tools

Veracode

Kali Linux

Job description

Barclay Simpson is partnering with a leading UK financial services organisation to hire an Application Security Engineer. You will focus on secure code reviews, SAST/DAST, vulnerability assessments and embedding security throughout the CI/CD lifecycle.

The role requires experience with OWASP Top 10, Veracode, DevSecOps, and cloud security across Azure/AWS, plus Kali Linux for manual testing. Hybrid work in London, Manchester or Glasgow with in-office presence ~1 day per week.