Senior Application Security Engineer: Lead Secure SDLC/ASPM

Duco; London Borough of Islington; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Annual bonus

Healthcare / private medical insurance

4x salary life assurance

Unlimited annual leave

Flexible working policy (2 days in/off

Opportunities to work abroad

Learning & development opportunities

Cycle to Work

Employee assistance programme

Tech Scheme

Volunteering days

Referral bonus

Job summary

Duco is seeking a Senior Application Security Engineer to own security across the SDLC and CI/CD pipelines. You’ll drive ASPM platform governance, threat modelling, and secure design reviews while partnering with Engineering to embed guardrails and reduce risk.

You will collaborate with our London and Wroclaw teams, influencing DevSecOps practices, securing the software supply chain, and preparing for client assurance reviews and audits.

Qualifications

• Proven experience in an application security, product security or DevSecOps role, ideally within a SaaS environment.
• Hands-on experience integrating security tooling into CI/CD pipelines.
• Track record of turning findings into prioritized remediation actions.
• Strong understanding of OWASP Top 10 and remediation strategies.
• Ability to read/review code in Java, Ruby or Python and explain risks.
• Experience with AWS and infrastructure-as-code, plus security automation.

Responsibilities

• Own security across our SDLC and CI/CD pipelines, embedding secure delivery as the default.
• Build and maintain pipeline security guardrails (SAST, SCA, secrets, IaC, container scanning).
• Strengthen software supply chain security with SBOMs and provenance tracking.
• Define pre-deployment cloud guardrails in policy-as-code with Engineering alignment.
• Lead threat modelling for new features and architecturally significant changes.
• Promote secure coding practices and run security champions network across Engineering.
• Represent platform security in client reviews and audits, reporting risk metrics.

Skills

Application security

DevSecOps

CI/CD

SAST

SCA

Threat modelling

OWASP Top 10

Python

AWS

Kubernetes

Tools

Ox Security

CI/CD tooling

Kubernetes

SAST tools

SBOMs

Job description

Duco is seeking a Senior Application Security Engineer to own security across the SDLC and CI/CD pipelines. You’ll drive ASPM platform governance, threat modelling, and secure design reviews while partnering with Engineering to embed guardrails and reduce risk.

You will collaborate with our London and Wroclaw teams, influencing DevSecOps practices, securing the software supply chain, and preparing for client assurance reviews and audits.