Remote App Security Engineer: Build Secure Software

Spencer Rose Ltd; United Kingdom; Hybrid; GBP 50,000 - 61,000; Full time

Job summary

Spencer Rose Ltd is seeking an experienced Application Security Engineer to work directly with development teams and embed security into every stage of the software development life cycle.

This hands-on role focuses on building secure software, partnering with engineers to identify vulnerabilities before production, and implementing automated security controls within CI/CD pipelines.

You will bridge Cyber Security and Engineering to ensure security is embedded from design to deployment.

Qualifications

• Proven experience in Application Security with vulnerability remediation and code review.
• Knowledge of OWASP Top 10, injection vulnerabilities, auth flaws, SSRF, deserialisation and API security.
• Hands-on experience implementing and operating SAST, DAST, and SCA tooling within CI/CD environments.
• Ability to review, understand, and discuss code in Java, Python, C++, or C#.
• Experience conducting threat modelling and translating security findings into practical engineering actions.
• Strong communication skills and ability to collaborate as an Embedded partner within engineering teams.
• Experience supporting secure API design and modern cloud-native application architectures.

Responsibilities

• Partner with development teams throughout the SDLC to identify, prioritise, and remediate application security vulnerabilities.
• Conduct manual code reviews and security testing on high-risk applications and components where automated tooling cannot provide sufficient coverage.
• Support secure software delivery by integrating security requirements into engineering practices and workflows.
• Provide technical guidance during security incidents involving application-layer vulnerabilities.
• Design, implement, and optimise SAST, DAST, and SCA tooling within CI/CD pipelines.
• Review third-party libraries and dependencies for vulnerabilities and licensing risks.
• Contribute evidence and control documentation for ISO 27001 and SOC 2 compliance.

Skills

Application security

Vulnerability remediation

Code reviews

CI/CD tooling

SAST/DAST/SCA

Java

Python

C++

C#

Tools

SonarQube

Snyk

Job description

Spencer Rose Ltd is seeking an experienced Application Security Engineer to work directly with development teams and embed security into every stage of the software development life cycle.

This hands-on role focuses on building secure software, partnering with engineers to identify vulnerabilities before production, and implementing automated security controls within CI/CD pipelines.

You will bridge Cyber Security and Engineering to ensure security is embedded from design to deployment.