Lead, Secure-by-Design Applications

Halfords Group PLC; West Midlands; Hybrid; GBP 85,000 - 105,000; Full time

Benefits offered by this job

Car allowance

Annual discretionary bonus

Pension

Life assurance

25 days annual leave + bank holidays

Enhanced family leave

Hybrid working

Job summary

Halfords Group PLC in Redditch, West Midlands, is seeking an Application Security Lead to own the security program across web, APIs, and internal apps. You will embed secure-by-design principles, conduct threat modelling, and drive security tooling and governance.

Hybrid role with 3 days in our Redditch Support Centre. You will partner with engineering and external suppliers to balance security with delivery pace and business value, shaping secure software across a large technology landscape.

Qualifications

• Proven experience leading or owning application security activities in modern SDLCs.
• Strong knowledge of application security principles and secure coding practices.
• Experience with SAST, DAST, SCA and secrets management tooling.
• Understanding of API security, OAuth2, OIDC and SAML.
• Familiarity with PCI-DSS requirements and their application.
• Industry security certifications (OSCP/OSCE or equivalent) are advantageous.

Responsibilities

• Own and develop the organisation's application security practice, embedding secure-by-design principles and controls.
• Lead threat modelling exercises and security design reviews for new apps, APIs, integrations, and major changes.
• Select, implement and manage application security tooling (SAST/DAST/SCA, secrets detection).
• Review testing results, assess risk, and provide remediation guidance to engineering teams.
• Act as an application security release gate and escalate as needed.
• Coordinate pen testing activities, manage suppliers, track findings and remediation.
• Collaborate with architects, developers and third-party providers to set practical security standards.

Skills

Application security

Secure coding

OWASP Top 10

CI/CD security

API security

PCI DSS

Education

OSCP/OSCE or equivalent

Tools

SAST

DAST

SCA

Secrets management

Vulnerability assessment tools

Job description

Halfords Group PLC in Redditch, West Midlands, is seeking an Application Security Lead to own the security program across web, APIs, and internal apps. You will embed secure-by-design principles, conduct threat modelling, and drive security tooling and governance.

Hybrid role with 3 days in our Redditch Support Centre. You will partner with engineering and external suppliers to balance security with delivery pace and business value, shaping secure software across a large technology landscape.