Senior Application Security Engineer - Embed in Engineering

Cloudsmith; Belfast City District; On-site; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Equity

Health, dental, vision insurance

Generous annual leave

Flexible working policies

Professional development budget

Belfast HQ for team activities

Job summary

Cloudsmith is seeking a Senior Application Security Engineer to embed inside an engineering tribe and advocate for security from within the core engineering function. You will review code and architecture, identify risks early, and land secure, pragmatic fixes in a fast-paced SaaS environment.

The role focuses on threat modeling, secure coding practices, and building tooling for SAST/DAST/CI‑CD security across AWS, Kubernetes, and multi-tenant architectures.

Qualifications

• 5+ years of hands-on application security experience, with security as your recent focus.
• Strong Python software engineering background; comfortable with security in code and architecture.
• Deep web and API security knowledge: OWASP Top 10, multi-tenant access control, authn/authz design, token handling.

Responsibilities

• Embed inside an engineering tribe and participate in planning, design review, code review, incidents learning, and delivery conversations.
• Collaborate across security, platform, and engineering guilds to route security work to the right team with proper priority.
• Threat‑model product and platform changes across APIs, data stores, queues, and identity.
• Review production code for authentication, authorization, data access, secrets handling, and abuse cases.
• Build and improve security tooling and automation that help engineers secure Cloudsmith.

Skills

Hands-on application security

Python

TypeScript

Go

Rust

Web API security

Threat modeling

Cloud security AWS

CI/CD security tooling

Security communication

Tools

Snyk

Semgrep

Trivy

Datadog

GitHub Advanced Security

Job description

Cloudsmith is seeking a Senior Application Security Engineer to embed inside an engineering tribe and advocate for security from within the core engineering function. You will review code and architecture, identify risks early, and land secure, pragmatic fixes in a fast-paced SaaS environment.

The role focuses on threat modeling, secure coding practices, and building tooling for SAST/DAST/CI‑CD security across AWS, Kubernetes, and multi-tenant architectures.