Senior Application Security Engineer

Anson McCade; United Kingdom; Remote; GBP 96,000 - 152,000; Full time

Job summary

Anson McCade Pty is seeking a Senior Application Security Engineer for a fully remote UK contract. The role focuses on implementing and maintaining robust application security controls within a large-scale health research platform.

You will collaborate with software engineers, DevOps and security architects to embed security into the development lifecycle. This is a hands-on engineering position requiring expertise in SAST, DAST, SCA, secure coding practices and cloud-native security across

Qualifications

• Proven hands-on experience in application security engineering.

Responsibilities

• Implement and maintain SAST, DAST and SCA in CI/CD pipelines.
• Embed automated security scanning and vulnerability detection into software delivery.
• Collaborate with developers to remediate vulnerabilities.
• Strengthen SSDLC practices across engineering teams.
• Conduct threat modelling, secure code reviews and API security assessments.
• Develop security automation using Python, Terraform and related tech.

Skills

SAST tooling

DAST tooling

SCA tooling

CI/CD integration

Python scripting

Terraform

Kubernetes

Azure

GitHub Actions

OWASP Top 10

Education

Bachelor's degree in Computer Science/related field

Tools

GitHub Actions

Azure

Kubernetes

AKS

Terraform

Python

Job description

Senior Application Security Engineer – Contract

Location: UK (fully remote)

IR35 Status: Inside IR35

Start Date: ASAP

The Opportunity

We are recruiting for an experienced Senior Application Security Engineer to support a major UK health research programme focused on transforming the prevention, detection and treatment of serious diseases.

This is an opportunity to work on a large-scale digital platform supporting pioneering health research, where the security of sensitive health and genetic information is critical.

You'll join an established security function, working closely with software engineers, DevOps teams and security architects to design, implement and maintain robust application security controls.

This is a genuinely hands‑on engineering position, not a general Cloud Security, DevSecOps or security governance role.

Key Responsibilities

• Implement and maintain SAST, DAST and SCA security tooling within CI/CD pipelines.
• Embed automated security scanning, quality gates and vulnerability detection into software delivery workflows.
• Work directly with developers to identify, investigate and remediate application security vulnerabilities.
• Strengthen Secure Software Development Lifecycle (SSDLC) practices across engineering teams.
• Conduct application threat modelling, secure code reviews and API security assessments.
• Develop security automation using Python, Terraform and other relevant technologies.
• Implement security controls across Azure, Kubernetes and AKS environments.
• Support policy-as-code implementation and automated security enforcement.
• Improve application security tooling, processes and developer adoption.
• Strong commercial experience in a dedicated Application Security Engineering role.
• Proven hands‑on implementation of SAST, DAST and SCA tooling.
• Experience integrating security controls into CI/CD pipelines, ideally GitHub Actions.
• Strong understanding of secure coding practices, OWASP Top 10 and application threat modelling.
• Practical experience securing APIs and modern cloud-native applications.
• Experience working directly with software engineering teams on vulnerability remediation.
• Ability to independently configure security tooling, troubleshoot integrations and implement technical security improvements.
• Python scripting and security automation.
• Terraform and Infrastructure as Code.
• Kubernetes, AKS and container security.
• Databricks, Snowflake or Dagster.
• ISO 27001 knowledge.

About You

We're looking for someone who enjoys getting hands‑on with technology and solving complex application security challenges.

You'll be comfortable working directly within engineering environments, configuring security tools, writing automation and implementing security controls that improve software security without unnecessarily slowing development.

You'll bring strong technical expertise, a collaborative approach and the ability to deliver practical security improvements from day one.