Senior Application Security Engineer

Bestman Solutions. International; Greater London; On-site; GBP 90,000 - 140,000; Full time

Job summary

Bestman Solutions. International in the United Kingdom is seeking a Senior Application Security Engineer to own application security across the SDLC and embed security in CI/CD. It is a hands-on role that shapes secure development and scalable security controls without slowing delivery.

You will lead tooling for SAST/SCA, ASPM and software supply chain security, and work with engineers to improve secure coding practices and perform security assessments.

Qualifications

• Experience in application security, product security or DevSecOps in SaaS.
• Hands-on with CI/CD security tooling and secure design reviews.
• Knowledge of SAST, SCA, vulnerability mgmt and secure SDLC.

Responsibilities

• Own and strengthen application security across the SDLC and CI/CD.
• Lead security tooling for SAST, SCA, secrets scanning, container security.
• Manage ASPM and risk-based vulnerability prioritisation.
• Partner with engineering to drive secure coding and remediation.

Skills

Application Security

DevSecOps

CI/CD security

Threat Modelling

SAST

SCA

Vulnerability mgmt

Secure SDLC

Cloud Security

Tools

CI/CD tooling

SBOM tooling

Container security tooling

Kubernetes security tooling

Job description

We're partnering with a growing, technology-led firm in the financial services industry to appoint a Senior Application Security Engineer.

The business develops a sophisticated SaaS platform used by some of the world's leading financial institutions, helping them automate complex data processes, strengthen controls and reduce operational risk.

As the platform continues to evolve, they're looking for an experienced security professional to take ownership of application and product security, working closely with Engineering to embed security throughout the software development lifecycle.

This is a hands-on role with genuine ownership. You'll have the opportunity to shape how security is built into products, influence engineering practices and establish scalable security controls without slowing down delivery.

The Role

Working within a collaborative Information Security function, you'll lead application security initiatives across the development lifecycle, from secure design and threat modelling through to CI/CD pipeline security and vulnerability remediation.

You'll work directly with developers, engineering leads and security colleagues to make secure development a natural part of how the business builds and releases software.

Key responsibilities include:

• Own and strengthen application security across the SDLC, embedding security controls into CI/CD pipelines.
• Lead the implementation and optimisation of security tooling across SAST, SCA, secrets scanning, container security and infrastructure-as-code.
• Take ownership of Application Security Posture Management (ASPM), ensuring vulnerabilities are prioritised based on genuine risk and exploitability.
• Partner with engineering teams to drive effective remediation and improve secure coding practices.
• Lead threat modelling, secure design reviews and security assessments for new features and architectural changes.
• Strengthen software supply chain security, including dependency management, SBOMs and build integrity.
• Help establish practical security standards, developer guidance and security champions across Engineering.
• Support client security reviews, audits and assurance activities.

About You

We're looking for someone who combines strong application security expertise with the technical credibility to work closely with software engineers.

You'll be comfortable getting into the detail, challenging technical decisions and translating security risks into practical improvements.

Ideally, you'll bring:

• Strong experience in Application Security, Product Security or DevSecOps, ideally within a SaaS or technology-driven environment.
• Hands-on experience integrating security tooling and controls into CI/CD pipelines.
• Practical knowledge of SAST, SCA, vulnerability management and secure software development.
• Experience conducting threat modelling, secure design reviews and application security assessments.
• The ability to read and review code in Java, Python or Ruby.
• Working knowledge of AWS, infrastructure-as-code and cloud security principles.
• A solid understanding of OWASP Top 10 and common application vulnerabilities.
• Strong communication skills and the ability to influence developers and engineering stakeholders.

Experience with ASPM platforms such as Ox Security, Kubernetes security, software supply chain security or securing AI/LLM applications would be particularly valuable.

A background in software engineering before moving into security would also be welcomed.

This is an opportunity to take real ownership of application security within a business where technology is central to the product, working alongside capable engineers and helping shape how security evolves as the platform grows.