Senior Application Security Architect - SAST/DAST,DevSecOps

Xpand Group; Greater London; Hybrid; GBP 115,000 - 138,000; Full time

Job summary

Xpand Group is seeking a Senior Application Security Consultant to join a large enterprise banking security function in London. The role focuses on embedding security across SDLC, with emphasis on SAST/DAST, threat modelling, and DevSecOps in a cloud environment.

You will collaborate with software engineering, cloud, architecture, and DevOps teams to ensure secure design, development, and deployment of applications. Hybrid work with 8 days onsite per month in London.

Qualifications

• Experience with Secure Software Development Lifecycle (SSDLC)
• Deep knowledge of OWASP Top 10 and secure coding practices
• Ability to perform secure design reviews and threat modelling
• Experience embedding security into CI/CD pipelines and DevSecOps practices

Responsibilities

• Lead application security reviews across business-critical apps and cloud platforms
• Conduct security architecture and secure design reviews
• Perform application security risk assessments and define security requirements
• Lead Threat Modelling workshops using STRIDE and MITRE ATT&CK
• Embed Secure SDLC in engineering teams and CI/CD pipelines
• Integrate security tooling into CI/CD and DevSecOps processes
• Review SAST/DAST/SCA findings and prioritise remediation
• Define security testing requirements and support penetration testing
• Produce security standards and best-practice documentation
• Act as Application Security SME across multiple programmes

Skills

SSDLC

OWASP Top 10

Secure Coding

Secure Design Reviews

API Security

REST APIs

Microservices Security

Application Security Risk Assessments

Tools

Checkmarx

Fortify

SonarQube

Veracode

Snyk

Burp Suite

OWASP ZAP

Job description

Xpand Group is seeking a Senior Application Security Consultant to join a large enterprise banking security function in London. The role focuses on embedding security across SDLC, with emphasis on SAST/DAST, threat modelling, and DevSecOps in a cloud environment.

You will collaborate with software engineering, cloud, architecture, and DevOps teams to ensure secure design, development, and deployment of applications. Hybrid work with 8 days onsite per month in London.