Secure SDLC & AppSec Advisory Lead

Barclay Simpson; City Of London; On-site; GBP 75,000 - 110,000; Full time

Job summary

Barclay Simpson is seeking a Technical Security Consultant to support the development and continuous improvement of a Secure Software Development Lifecycle (SDLC) capability. This role blends secure SDLC, DevSecOps, application security and architecture expertise to assess control effectiveness, tooling coverage and adoption across modern engineering environments.

Key responsibilities include assessing SDLC controls, reviewing security architecture and tooling, mapping controls to frameworks

Qualifications

• Strong Secure SDLC, DevSecOps or Application Security experience.
• Good understanding of security controls throughout the software development lifecycle.
• Experience with security assurance, control frameworks, architecture or capability mapping.

Responsibilities

• Assess Secure SDLC controls across design, development, testing, release and operation.
• Review security architecture, tooling coverage, integration dependencies and control gaps.
• Assess capabilities incl. SAST, SCA, DAST, secrets scanning, IaC scanning, API security, threat modelling and CI/CD security.
• Map controls against frameworks including NIST SSDF, OWASP SAMM and OWASP DSOMM.
• Review security tooling and integrations across GitHub, GitLab, CI/CD and cloud environments.
• Conduct control-effectiveness assessments, evidence reviews and maturity/gap analysis.
• Facilitate workshops with engineering, security and product teams.
• Support KPI/KRI development, assurance reporting and remediation oversight.

Skills

Secure SDLC

DevSecOps

Application Security

Stakeholder management

Vulnerability management

Exception governance

Remediation oversight

Tools

GitHub Advanced Security

CodeQL

Dependabot

Fortify

Qualys

Checkov

Job description

Barclay Simpson is seeking a Technical Security Consultant to support the development and continuous improvement of a Secure Software Development Lifecycle (SDLC) capability. This role blends secure SDLC, DevSecOps, application security and architecture expertise to assess control effectiveness, tooling coverage and adoption across modern engineering environments.

Key responsibilities include assessing SDLC controls, reviewing security architecture and tooling, mapping controls to frameworks