Hybrid Lead: Application Security & Secure-by-Design

Bupa; Salford; Hybrid; GBP 90,000 - 120,000; Full time

Benefits offered by this job

25 days holiday

Enhanced pension

Private medical insurance

Flexible working

Disability Confident Employer

Job summary

Bupa is seeking a Lead Application Security Engineer to shape secure-by-design practices across UK development teams. The role blends hands-on security tooling with leadership to advance our security posture in a hybrid work model, spanning London, Staines and Salford Quays.

You will drive automation, mentor engineers, and partner with product, engineering and compliance teams to ensure ISO 27001, NIST and GDPR alignment across the software lifecycle.

Qualifications

• Experience leading application security programmes and tooling.
• Strong knowledge of SCA, SAST, DAST and related technologies.
• Experience integrating security into CI/CD pipelines.
• Experience with automation and scripting.
• Knowledge of ISO 27001, NIST and GDPR.

Responsibilities

• Lead design and improvement of application security tooling.
• Provide technical leadership for SCA/SAST/DAST and container security.
• Integrate security tooling into CI/CD workflows.
• Mentor engineers and build a high-performing team.
• Develop security metrics and respond to incidents.
• Ensure controls meet industry standards and regulatory requirements.

Skills

AppSec leadership

Secure coding principles

CI/CD integration

Automation scripting

Communication skills

DevSecOps

Security frameworks knowledge

Education

Degree in Cyber Security / IT

CISSP/CISM/CISA certification

Tools

Terraform

PowerShell

Python

REST APIs

Job description

Bupa is seeking a Lead Application Security Engineer to shape secure-by-design practices across UK development teams. The role blends hands-on security tooling with leadership to advance our security posture in a hybrid work model, spanning London, Staines and Salford Quays.

You will drive automation, mentor engineers, and partner with product, engineering and compliance teams to ensure ISO 27001, NIST and GDPR alignment across the software lifecycle.