Senior AppSec Engineer — AI-Smart Secure SDLC (Hybrid)

Redgate; Cambridge; Hybrid; GBP 60,000 - 75,000; Full time

Benefits offered by this job

Private health insurance

Job summary

Redgate is seeking an embedded security expert within its Product Security team in Cambridge. You will define and operationalise security requirements across the SDLC, with authority to make independent security calls rather than relying on scanners.

The role works across multiple product teams to embed secure-by-default standards and governance, shaping how security is done. You will partner with engineering and product teams, lead threat modelling for new features, drive SAST/DAST adoption,

Qualifications

• Hands-on product or application security experience across the SDLC.
• Ability to review code and communicate security issues clearly to developers in a C# ecosystem, with exposure to Java or Python.
• Strong knowledge of the OWASP Top 10 and practical mitigation patterns.
• Experience implementing or improving SAST/DAST processes: tool tuning, triage workflows, reducing signal to noise.
• Working understanding of cloud and container security fundamentals, ideally with AWS and Docker.

Responsibilities

• Partner directly with engineering and product teams to define and operationalise security requirements across the full SDLC.
• Own or co‑own application security governance: secure‑by‑default standards, patterns, guardrails, and risk exceptions.
• Lead threat modelling for new features and architectural changes, turning findings into practical engineering work.
• Drive SAST/DAST adoption and quality, from tool tuning to severity calibration and developer‑facing triage guidance.
• Support product teams adopting AI, including LLMs, SLMs, and MCP, giving you visibility into work most security roles wouldn’t touch.

Skills

Application security

Code review

OWASP Top 10

SAST/DAST

AWS

Docker

C#

Java

Python

Tools

Docker

AWS

Job description

Redgate is seeking an embedded security expert within its Product Security team in Cambridge. You will define and operationalise security requirements across the SDLC, with authority to make independent security calls rather than relying on scanners.

The role works across multiple product teams to embed secure-by-default standards and governance, shaping how security is done. You will partner with engineering and product teams, lead threat modelling for new features, drive SAST/DAST adoption,