Senior App Security Lead – Secure-by-Design & DevSecOps

Bupa; Stretford; Hybrid; GBP 110,000 - 140,000; Full time

Benefits offered by this job

25 days holiday

Enhanced pension

Private medical insurance

Health & wellbeing services

Discounts on products

Job summary

Bupa is seeking a Lead Application Security Engineer in a hybrid, permanent role covering London, Staines and Salford Quays. You will lead application security tooling, mentor engineers and embed secure-by-design across the software lifecycle.

You will drive automation with SCA/SAST/DAST, container security and scripting in Terraform, PowerShell and Python, collaborating with engineering, product and compliance teams to strengthen security posture.

Qualifications

• Significant experience designing and leading application security programmes.
• Proven ability to embed secure-by-design across the SDLC.
• Strong knowledge of SCA/SAST/DAST tooling and secure coding practices.

Responsibilities

• Lead design and ongoing improvement of application security tooling.
• Provide technical leadership for secure development technologies and processes.
• Integrate security tooling into CI/CD and workflows.
• Mentor engineers and build a high-performing security team.
• Drive automation and incident response across platforms.

Skills

Application security leadership

Secure development

CI/CD security

Automation scripting

Terraform

PowerShell

Python

REST APIs

ISO 27001 / NIST / GDPR

Team mentorship

Education

Cyber Security degree or related

Professional certs (CISSP/CISM/CISA)

Tools

SCA

SAST

DAST

Container security

Job description

Bupa is seeking a Lead Application Security Engineer in a hybrid, permanent role covering London, Staines and Salford Quays. You will lead application security tooling, mentor engineers and embed secure-by-design across the software lifecycle.

You will drive automation with SCA/SAST/DAST, container security and scripting in Terraform, PowerShell and Python, collaborating with engineering, product and compliance teams to strengthen security posture.