Senior Application Security Engineer

Synechron; Greater London; Hybrid; GBP 90,000 - 140,000; Full time

Job summary

Synechron in London is seeking a Senior Application Security Engineer to lead the design and execution of our Application Security Programme. You will identify vulnerabilities, perform tests, and work with development teams to promote secure coding practices.

Responsibilities include secure design, KPI reporting, and staying current with security trends while guiding teams through risk-based decisions in a hybrid, multi-project environment.

Qualifications

• 5+ years in application security engineering.
• OWASP Top 10 & CWE knowledge
• Secure coding practices & SDLC
• CI/CD security controls (Checkmarx, Nexus, Prisma)
• Web app & cloud security expertise
• HTTP, WebSocket, SQL, JSON, Protobufs
• TLS cryptography fundamentals
• Vulnerability assessment & pen testing results
• Cloud security (CNAPP, Docker/Kubernetes, AWS Lambda)
• Strong communication and leadership

Responsibilities

• Lead ongoing application security testing across products.
• Collaborate with devs to design secure architectures.
• Perform code reviews to spot security flaws.
• Explain vulnerabilities to stakeholders clearly.
• Guide vulnerability management lifecycle and fixes.
• Advise developers on secure coding practices.
• Produce KPI reports on security posture.
• Evaluate security tools and processes.
• Ensure compliance with security standards & regulations.
• Identify advanced vulnerabilities via modern tests.
• Document security architectures and guidelines.

Skills

Application security

Penetration testing

Code reviews

Secure coding

CI/CD security

Cloud security

Web security

TLS/cryptography

Vulnerability mgmt

Team leadership

Tools

Burp Suite Pro

Fiddler

Chrome DevTools

SQLmap

Wireshark

Checkmarx

Sonatype Nexus

Prisma

SAST/DAST tools

Job description

Job Role:

Senior Application Security Engineer

Job Location:

London, UK

Experience:

Mid-Senior Level

Work Type:

Hybrid / Open for full-time & Contract

About Company:

At Synechron, we believe in the power of digital to transform businesses for the better. Our global consulting firm combines creativity and innovative technology to deliver industry-leading digital solutions. Synechron’s progressive technologies and optimization strategies span end-to-end Artificial Intelligence, Consulting, Digital, Cloud & DevOps, Data, and Software Engineering, servicing an array of noteworthy financial services and technology firms. Through research and development initiatives in our FinLabs we develop solutions for modernization, from Artificial Intelligence and Blockchain to Data Science models, Digital Underwriting, mobile-first applications and more. Over the last 20+ years, our company has been honored with multiple employer awards, recognizing our commitment to our talented teams. With top clients to boast about, Synechron has a global workforce of 14,700+ and has 55 offices in 20 countries within key global markets. For more information on the company, please visit our website or LinkedIn community.

Diversity, Equity, and Inclusion

Diversity & Inclusion are fundamental to our culture, and Synechron is proud to be an equal opportunity workplace and an affirmative-action employer. Our Diversity, Equity, and Inclusion (DEI) initiative Same Difference is committed to fostering an inclusive culture – promoting equality, diversity and an environment that is respectful to all. We strongly believe that a diverse workforce helps build stronger, successful businesses as a global company. We encourage applicants from across diverse backgrounds, race, ethnicities, religion, age, marital status, gender, sexual orientations, or disabilities to apply. We empower our global workforce by offering flexible workplace arrangements, mentoring, internal mobility, learning and development programs, and more.

All employment decisions at Synechron are based on business needs, job requirements and individual qualifications, without regard to the applicant’s gender, gender identity, sexual orientation, race, ethnicity, disabled or veteran status, or any other characteristic protected by law.

Job Description Summary:

A Senior Application Security Engineer will be responsible for implementing the design and execution of our Application Security Programme including architecting secure design principles, identifying complex vulnerabilities, conducting security assessments and working closely with development teams to promote secure coding practices.

Primary Responsibilities:

• Define, lead, and execute ongoing application security testing against the organisation’s product suite.
• Collaborate with development and product teams to design secure application architectures that meet business requirements while minimizing security risks.
• Perform thorough code reviews to identify security flaws, coding errors and potential attack vectors in application codebases.
• Articulate complex technical vulnerabilities in a clear, actionable manner to key stakeholders, including development teams, product owners, and executive leadership.
• Provide guidance on the application vulnerability management lifecycle, tracking vulnerabilities according to our risk management process and ensuring development teams successfully resolve identified issues.
• Provide guidance to developers and other team members on secure coding practices, security best practices and latest security trends.
• Define, maintain, and present Key Performance Indicator (KPI) reports and metrics summarizing the organization's application security posture.
• Stay up to date with the latest security tools and technologies & evaluate their effectiveness in streamlining application security objectives.
• Ensure applications adhere to relevant security standards, regulations & industry best practices.
• Identify advanced application-level security vulnerabilities in our products using modern penetration testing techniques and threat modeling.
• Create and maintain detailed documentation related to application security architectures, design decisions and security guidelines.

Additional Responsibilities:

• Cultivate strategic relationships with development teams and engineering leadership to ensure smooth execution and cultural adoption of the security testing programme.
• Partner with development and DevOps teams to architect and automate security tests and guardrails into continuous integration/continuous deployment (CI/CD) pipelines.
• Maintain deep expertise in emerging technologies, novel attack vectors, and evolving vulnerability landscapes.

Required Skills:

• Proven hands-on experience (ideally 5+ years) of performing application security engineering; penetration tests and security code reviews.
• Deep, authoritative knowledge of key application security vulnerabilities (OWASP Top 10, CWE Top 25) and how to remediate them.
• Experience with secure coding practices and secure development lifecycle. Knowledge of modern development methodologies.
• Experience with designing controls for securing CI/CD environments (such as Checkmarx, Sonatype Nexus, Prisma)
• Strong understanding of web application, cloud security and microservices architectures.
• Advanced knowledge of key application layer protocols and data formats (HTTP, WebSocket, SQL, JSON, Protobufs).
• Deep working knowledge of cryptographic protocols, implementations, and best practices (TLS).
• Experience with interpreting vulnerability scanning and penetration testing results.
• Previous knowledge in conducting penetration testing as well as penetration testing methodologies is a plus.
• Strong knowledge of cloud security and cloud architecture (CNAPP, Docker/Kubernetes, AWS Lambda).
• Working understanding of network protocols, firewall configurations and common web protocols.
• Expert-level use of common industry tools (Burp Suite Professional, Fiddler, Chrome/FF dev tools, SQLmap, Wireshark, Checkmarx, Sonatype Nexus, Prisma and SAST/DAST tools).
• Excellent written and verbal communication skills—able to express complex technical issues in a concise, accurate, and business-impact context.
• Self-motivated leader and continuous learner, capable of driving security initiatives independently.
• Exceptional teamwork and leadership skills—able to collaborate effectively and influence cross-functional teams, developing relationships with technical stakeholders.
• Strong pragmatism—expert at identifying strategic compromises that balance security risk with business and engineering delivery needs.

Desirable Qualifications:

• SANS GXPN (GIAC Exploit Researcher and Advanced Penetration Tester)
• OSCP / OSWE (Offensive Security Certified Professional / Web Expert)

Relevant certifications such as CISSP, OSCE, OSEE, CCSAS.