Senior Application Security Engineer

Runtime; United Kingdom; Remote; GBP 117,000 - 143,000; Full time

Benefits offered by this job

Fully remote

Flexible hours

35 days annual leave

Pension matched 8%

Private medical

Dental and optical cover

Sick leave

Income protection

Life insurance

Equity

Job summary

Runtime is seeking an engineer who has moved into security or who has done real security work alongside writing code. You will work with engineering teams as a peer, reviewing designs and code, and building security tooling that runs in production.

You will lead threat modelling, secure design reviews, and own SAST, DAST and SCA, integrating automation across a cloud-native AWS stack. Strong AWS security experience is essential for this role.

Qualifications

• Software engineering background with production code experience.
• Hands-on security work: threat modelling, OWASP, secure code review.
• 5+ years in engineering and/or security combined.
• Strong AWS security experience across a cloud-native stack.

Responsibilities

• Lead threat modelling and secure design reviews with engineering teams from the start of a project.
• Carry out secure code reviews against OWASP Top 10 and ASVS, and coach engineers to catch issues themselves.
• Own SAST, DAST and SCA, writing the automation and integrations around them.
• Harden APIs, containers, IaC and CI/CD pipelines across a cloud-native AWS stack.
• Run penetration tests and vulnerability assessments across services and infrastructure.
• Act as technical lead during incident response and red/blue exercises.
• Build security tooling from scratch to production standard.

Skills

Software engineering background

Hands-on security work

5+ years in engineering and/orSecurity

Strong AWS security experience

Security tooling familiarity

Team collaboration

Curiosity (CTFs, bug bounties)

Tools

SAST tools

DAST tools

SCA tools

AWS security tooling

Job description

Built software first. Now you’d rather break it.

This one’s for engineers who’ve moved into security, or who are still writing code day to day but have done real security work alongside it. If you’ve shipped production systems, then found yourself running threat models, digging into OWASP and becoming the person your team asks "is this safe?", read on.

The problem

Most attacks don’t come through the front door. They come through something that was already let in: a dependency, a package, a library that looked legitimate. The software engineers build today is only as secure as everything it quietly pulls in, and AI is making that problem harder by the month. Regulators are watching, enterprise security teams are scrambling, and this company is building the infrastructure to get ahead of it.

Why an engineer’s background matters here

This isn’t a compliance role or a scanner-babysitting job. You’ll sit with engineering teams as a peer, reviewing designs and code, and building security tooling that has to run in production. People who’vE built and shipped software tend to be best at this, because they understand how systems actually get made and where they actually break.

What you’ll do

• Lead threat modelling and secure design reviews with engineering teams from the start of a project
• Carry out secure code reviews against OWASP Top 10 and ASVS, and coach engineers to catch issues themselves
• Own SAST, DAST and SCA, writing the automation and integrations around them
• Harden APIs, containers, IaC and CI/CD pipelines across a cloud-native AWS stack
• Run penetration tests and vulnerability assessments across services and infrastructure
• Act as technical lead during incident response and red/blue exercises
• Build security tooling from scratch to production standard

What you’ll bring

• A software engineering background: you’ve designed, built and shipped production code, and you still enjoy writing it
• Solid hands-on security work, whether in a dedicated AppSec role or alongside your engineering job: threat modelling, OWASP, secure code review, vulnerability remediation
• Around 5+ years in engineering and/or security combined
• Strong AWS security experience, since the whole platform runs on it
• Depth with security tooling (which products matters less than how well you know them)
• Low ego and a collaborative style that suits a small, close-knit team
• Curiosity. CTFs, bug bounties and home labs are all green flags

The package

Up to £130,000 depending on experience, plus equity with real upside. The technical founders set up the structure to reward engineers properly, and the company is on an IPO trajectory over the next 3–5 years. You’ll also get 35 days’ annual leave plus your birthday off, fully remote working with flexible hours, a pension matched up to 8%, private medical, dental and optical cover, and paid sick leave, income protection and life insurance.

Interested?

Drop me a message. Details stay confidential until we’ve spoken. This role isn’t being advertised widely, so if you’re an engineer who’s caught the security bug, it’s worth a conversation.