Senior App Security Lead: Threat Modelling & Pen Tests

Global Relay; England; On-site; GBP 90,000 - 120,000; Full time

Job summary

Global Relay seeks a Senior Application Security Specialist to lead advanced testing of critical applications and services, conduct deep vulnerability analyses and model threats across the product security function.

You will mentor analysts, act as security liaison to engineering, define testing standards and drive secure design in collaboration with product teams, while shaping security strategy and metrics across the CI/CD lifecycle.

Qualifications

• 5–8 years hands-on experience in application security testing.
• Advanced knowledge of internet and network technologies.
• Expert understanding of web and API technologies and vulnerabilities (OWASP Top 10, API/LLM Top 10, Mobile Top 10).
• Advanced mobile security testing (Android/iOS)—reverse engineering, runtime manipulation, Frida scripting, Objection.
• Advanced knowledge of container orchestration and Kubernetes security, RBAC and workload isolation.
• Advanced AI/LLM security assessment.
• Expert understanding of security controls and how to assess their effectiveness at scale.
• Strong offensive security skillset—manual web and API testing, authentication/authorization bypass, session management, business-logic abuse and data-protection testing.
• Advanced knowledge of threat remediation techniques for programming languages used at Global Relay.
• Strong awareness of MITRE ATT&CK and APTs and how to apply to test strategy design.
• Automation scripting (Python, Bash) and CI/CD tooling integration (TestRail/Jira, Burp Suite Pro).
• Excellent communication skills and stakeholder influence.
• OSCP/OSWE certifications preferred.

Responsibilities

• Lead advanced security testing of critical applications and services, including deep-dive manual testing and targeted penetration tests across web, mobile and API surfaces.
• Own threat modelling using structured frameworks (STRIDE, PASTA), producing threat models for new features and architecture changes.
• Support and engage in the penetration testing programme.
• Design security test strategies for new products and major changes.
• Act as subject-matter expert and primary point of contact between engineering and the Application Security team.
• Provide oversight of scanning-tool usage and KPIs in the CI/CD pipeline.
• Own the overarching triage, escalation and evidence-quality framework across all scanning tools and testing streams, mentoring L1/L2 analysts.
• Track and report key security testing metrics to senior stakeholders.
• Build and maintain advanced test cases, automation frameworks and custom tooling.
• Own the security release process, including remediation verification and closure standards.
• Mentor and coach analysts; provide training material and playbooks.

Education

OSCP/OSWE certifications

Tools

Burp Suite Pro

TestRail

Jira

Postman

SonarQube

Job description

Global Relay seeks a Senior Application Security Specialist to lead advanced testing of critical applications and services, conduct deep vulnerability analyses and model threats across the product security function.

You will mentor analysts, act as security liaison to engineering, define testing standards and drive secure design in collaboration with product teams, while shaping security strategy and metrics across the CI/CD lifecycle.