Senior Application Security Engineer

McCabe & Barton; Greater London; On-site; GBP 60,000 - 90,000; Full time

Job summary

McCabe & Barton seeks a Cyber Security Engineer in London to strengthen security controls across critical business platforms and infrastructure in a fast-paced, highly regulated private equity setting.

You will drive triage governance, implement FIDO2/WebAuthn, perform third-party reviews, and enhance monitoring with SIEM/UEBA while supporting vulnerability patching and micro-segmentation efforts.

Qualifications

• Experience in Security Operations, Threat Analysis or Cyber Security Analysis.
• Experience in financial services, private equity, or a regulated environment.
• Hands-on with SIEM, UEBA, EDR and identity management technologies including Entra ID and Conditional Access.

Responsibilities

• Drive triage and remediation governance for AI-assisted code audit of proprietary products.
• Support rollout of FIDO2/WebAuthn across privileged accounts and Entra admin roles.
• Assist with third-party trust boundary reviews.
• Maintain and enhance the emergency patching runbook for critical vulnerabilities (CVSS 9.0+).
• Contribute to micro-segmentation of proprietary apps from M365 workloads, including honeytoken deployment for early-warning threat detection.
• Run continuous External Attack Surface Management (EASM) across the firm's external footprint and cross-reference findings weekly with the CMDB.
• Support SIEM and UEBA enhancements, building detection logic around deal workflow baselines.

Skills

SIEM

UEBA

EDR

Entra ID

Conditional Access

FIDO2/WebAuthn

App security vulnerabilities

SBOMs

Tools

Entra Admin Console

Job description

We are working with a leading private equity firm seeking a Cyber Security Engineer to join their London office. This is an exciting opportunity to join a fast-paced, highly regulated environment and play a key role in strengthening cyber security controls across critical business platforms and infrastructure.

Key Responsibilities

• Drive triage and remediation governance for the AI-assisted code audit of proprietary products.
• Support the rollout of FIDO2/WebAuthn across all privileged accounts with access to proprietary systems and Entra admin roles.
• Assist with third-party trust boundary reviews.
• Maintain and enhance the emergency patching runbook for critical vulnerabilities (CVSS 9.0+).
• Contribute to the micro-segmentation of proprietary applications from general M365 workloads, including honeytoken deployment for early-warning threat detection.
• Run continuous External Attack Surface Management (EASM) across the firm's external footprint and cross-reference findings weekly with the CMDB.
• Support SIEM and UEBA enhancements, building detection logic around normal deal workflow behavioural baselines.

Skills & Experience

• Previous experience within Security Operations, Cyber Security Analysis, or Threat Analysis.
• Experience working within financial services, private equity, or another regulated environment
• Hands-on experience with SIEM, UEBA, EDR, and identity management technologies including Entra ID, Conditional Access, and FIDO2/WebAuthn.
• Good understanding of application security vulnerabilities including deserialisation, IDOR, injection, and authorisation logic flaws.
• Working knowledge of software supply chain security practices, including SBOMs, Software Composition Analysis (SCA), and dependency management.
• Understanding of DORA ICT risk obligations is desirable
• Self-motivated and capable of operating independently within a fast-paced, evolving environment.