Lead App Security Engineer: Threat Modelling & Cloud

Legal Counsel - 12 month FTC at Rightmove Greenhouse; Greater London; Hybrid; GBP 60,000 - 90,000; Full time

Benefits offered by this job

Private Medical Insurance

Pension

27 days holiday

Life Insurance

Employee Assistance Plan

Job summary

Rightmove is hiring an Application Security Engineer to join the growing AppSec function. You will work with engineering teams to deliver day-to-day AppSec capabilities, including tooling, vulnerability management, secure design, and threat modelling, helping the function mature.

You will triage security findings, perform risk-based reviews, and engage with multiple squads to improve overall security posture. A hybrid work model with office days is in place.

Qualifications

• Experience in application security or security engineering.
• Ability to assess security findings in context and make pragmatic recommendations.
• Proficient in Python for internal tooling and scripting.
• Experience with SAST/DAST/SCA/secrets scanning tools.

Responsibilities

• Triage and classify security findings across repositories; drive remediation.
• Operate vulnerability management and monitoring; engage with engineers.
• Maintain guidance for resolving vulnerabilities and exceptions.
• Conduct secure design reviews for new services and integrations.
• Facilitate threat modelling sessions and improve practices across squads.

Skills

Application security

Python scripting

Threat modelling

Vulnerability management

Security tooling

CI/CD security

Communication

Tools

Aikido

Snyk

Semgrep

Checkmarx

Prisma Cloud

GitLab CI

Job description

Rightmove is hiring an Application Security Engineer to join the growing AppSec function. You will work with engineering teams to deliver day-to-day AppSec capabilities, including tooling, vulnerability management, secure design, and threat modelling, helping the function mature.

You will triage security findings, perform risk-based reviews, and engage with multiple squads to improve overall security posture. A hybrid work model with office days is in place.