Principal Application Security Leader — Flexible Hours

RELX International; Greater London; Hybrid; GBP 110,000 - 160,000; Full time

Job summary

RX Global, part of RELX, seeks a Principal Application Security Engineer to lead security across its global technology estate and partner with engineering leadership to embed security by design.

The role combines technical leadership, threat modelling, secure governance, and posture management across cloud-native and API-rich environments. This is a highly visible, enterprise-wide IC role with cross-functional impact.

Qualifications

• Significant experience in Application Security, Product Security, or Security Engineering.
• Understanding of modern software development methodologies and engineering practices.
• Experience implementing Secure Development Lifecycle programmes.
• Experience conducting threat modelling and architecture security reviews.

Responsibilities

• Lead the RX Application Security programme, defining strategy, roadmap, standards, controls, and maturity goals.
• Embed Secure by Design across the SDLC with threat modelling and security reviews.
• Own and mature the Application Security Posture Management capability with tooling.
• Develop KPIs, dashboards, and reports for engineers and executives, driving automation.
• Oversee vulnerability management across apps and platforms including SAST/DAST and CI/CD security.
• Partner with directors, architects, and engineers to promote secure coding and design.

Skills

Application Security

Threat Modelling

Secure SDLC

Security Architecture

Tools

OWASP Top 10

SAST

DAST

SCA

IaC Security

CI/CD Security

API Security

Job description

RX Global, part of RELX, seeks a Principal Application Security Engineer to lead security across its global technology estate and partner with engineering leadership to embed security by design.

The role combines technical leadership, threat modelling, secure governance, and posture management across cloud-native and API-rich environments. This is a highly visible, enterprise-wide IC role with cross-functional impact.