Lead AppSec Engineer — Remote, Equity, Flexible Hours

Runtime; United Kingdom; Remote; GBP 117,000 - 143,000; Full time

Benefits offered by this job

Fully remote

Flexible hours

35 days annual leave

Pension matched 8%

Private medical

Dental and optical cover

Sick leave

Income protection

Life insurance

Equity

Job summary

Runtime is seeking an engineer who has moved into security or who has done real security work alongside writing code. You will work with engineering teams as a peer, reviewing designs and code, and building security tooling that runs in production.

You will lead threat modelling, secure design reviews, and own SAST, DAST and SCA, integrating automation across a cloud-native AWS stack. Strong AWS security experience is essential for this role.

Qualifications

• Software engineering background with production code experience.
• Hands-on security work: threat modelling, OWASP, secure code review.
• 5+ years in engineering and/or security combined.
• Strong AWS security experience across a cloud-native stack.

Responsibilities

• Lead threat modelling and secure design reviews with engineering teams from the start of a project.
• Carry out secure code reviews against OWASP Top 10 and ASVS, and coach engineers to catch issues themselves.
• Own SAST, DAST and SCA, writing the automation and integrations around them.
• Harden APIs, containers, IaC and CI/CD pipelines across a cloud-native AWS stack.
• Run penetration tests and vulnerability assessments across services and infrastructure.
• Act as technical lead during incident response and red/blue exercises.
• Build security tooling from scratch to production standard.

Skills

Software engineering background

Hands-on security work

5+ years in engineering and/orSecurity

Strong AWS security experience

Security tooling familiarity

Team collaboration

Curiosity (CTFs, bug bounties)

Tools

SAST tools

DAST tools

SCA tools

AWS security tooling

Job description

Runtime is seeking an engineer who has moved into security or who has done real security work alongside writing code. You will work with engineering teams as a peer, reviewing designs and code, and building security tooling that runs in production.

You will lead threat modelling, secure design reviews, and own SAST, DAST and SCA, integrating automation across a cloud-native AWS stack. Strong AWS security experience is essential for this role.