London-based Lead AppSec Engineer — Secure SaaS

Crane Venture Partners; Greater London; On-site; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Competitive salary

Equity in high-growth startup

London office 4+ days/week

25 days annual leave

Learning & development budget

Travel for customer visits

Daily company lunches

Team socials & offsites

Job summary

Encord is seeking a Lead Security Engineer to own application security across our platform and embed secure practices throughout the development lifecycle. The role requires 7+ years of hands-on AppSec experience, strong Python/TypeScript coding, and deep web/API security knowledge.

You will secure a cloud-native SaaS with AWS/GCP, Kubernetes, and CI/CD pipelines while mentoring engineers and guiding security strategy across the organization.

Qualifications

• 7+ years in software or security engineering with hands-on AppSec.
• Strong coding ability in Python and/or TypeScript.
• Deep knowledge of web and API security (OWASP Top 10, OAuth/OIDC, authz models).
• Experience securing cloud-native SaaS (GCP or AWS, Kubernetes).
• Track record building security tooling and processes in a fast-moving product company.
• Clear communicator who can influence engineering teams and speak to enterprise customers.

Responsibilities

• Own the application security program end to end: threat modelling, secure design reviews, code review, and vulnerability management.
• Build security into the SDLC with SAST, DAST, dependency/SCA, and secrets scanning integrated into CI/CD without slowing teams down.
• Partner with engineering on authentication, authorization, multi-tenancy isolation, and data protection across our APIs and SDKs.
• Lead penetration testing, bug bounty triage, and incident response for application-layer issues.
• Support customer security reviews and compliance (SOC 2, HIPAA, GDPR) with practical technical controls.
• Mentor engineers and raise the security bar across the organisation.

Skills

Python

TypeScript

AppSec experience

Security tooling

Threat modelling

Tools

AWS

GCP

Kubernetes

CI/CD

SAST tooling

Job description

Encord is seeking a Lead Security Engineer to own application security across our platform and embed secure practices throughout the development lifecycle. The role requires 7+ years of hands-on AppSec experience, strong Python/TypeScript coding, and deep web/API security knowledge.

You will secure a cloud-native SaaS with AWS/GCP, Kubernetes, and CI/CD pipelines while mentoring engineers and guiding security strategy across the organization.