Lead Application Security Engineer – ASPM & Secure SDLC

Duco; Greater London; Hybrid; GBP 90,000 - 135,000; Full time

Benefits offered by this job

Healthcare cashback scheme

Private medical insurance

4X salary life assurance

Unlimited annual holiday

Flexible working policy

Work abroad up to 6 weeks

Learning and development opportunities

Job summary

Duco, headquartered in London with offices worldwide, is hiring a Senior Application Security Engineer to own security across the SDLC. You will govern Ox Security ASPM, tune policy, and drive remediation with engineering teams while shaping threat modelling and secure design.

Join a small, collaborative Information Security team reporting to the Head of Information Security. You will partner with Engineering to embed security guardrails into CI/CD and to ensure secure development across our

Qualifications

• Proven experience in application security or DevSecOps in SaaS.
• Experience integrating security tooling into CI/CD pipelines.
• Strong knowledge of OWASP Top 10 and remediation practices.
• Ability to read/assess code in Java, Ruby or Python.

Responsibilities

• Own security across the SDLC and CI/CD pipelines, embedding secure delivery by default.
• Manage Ox Security ASPM platform with tuning and remediation prioritisation.
• Lead threat modelling for new features and architecture changes.
• Represent platform security in client reviews and maintain security metrics.

Skills

CI/CD pipelines

SAST

SCA

Secrets scanning

IaC

Container security

OWASP Top 10

Java

Ruby

Python

AWS

Threat modelling

Security tooling

Tools

Ox Security

Kubernetes

AWS Cloud

Job description

Duco, headquartered in London with offices worldwide, is hiring a Senior Application Security Engineer to own security across the SDLC. You will govern Ox Security ASPM, tune policy, and drive remediation with engineering teams while shaping threat modelling and secure design.

Join a small, collaborative Information Security team reporting to the Head of Information Security. You will partner with Engineering to embed security guardrails into CI/CD and to ensure secure development across our