Senior AppSec Engineer - Lead Secure SDLC & Modelling

Flagstone; Greater London; On-site; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Bonus scheme

Benefits budget

Salary sacrifice

Around the World

Wellbeing support

Development budget

Private health care

Medical cash plan

Life insurance

Pension contributions

Holiday entitlement

Parental Leave

Job summary

Flagstone is recruiting a Senior Application Security Engineer to own AppSec end-to-end across the development lifecycle. You will partner with product engineering teams to embed security from design through deployment, not as an afterthought.

In this hands-on role, you will lead threat modelling, secure design reviews, and secure coding practices, while building scalable security programs, champions, and risk management across the application estate.

Qualifications

• 5+ years in application security or a security engineering role with a strong AppSec component.
• Experience embedding security in the SDLC: threat modelling frameworks (e.g. STRIDE), secure design review, and working directly with engineering teams.
• Hands-on experience with SAST/DAST/SCA tooling and CI/CD pipeline integration.
• Strong grasp of OWASP Top 10 and secure coding practices across at least one major language/framework used in a production environment.
• Experience coordinating and running penetration testing programmes, including remediation tracking.
• Comfortable communicating security risk clearly to engineering and product audiences and influencing senior leadership.
• Demonstrated experience in reviewing, threat modelling and securing agentic and AI systems.
• Great communication skills and stakeholder management, which includes influencing stakeholders and creating relationships.
• Strong critical thinking skills and a curiosity for learning new technologies and frameworks.

Responsibilities

• Own the AppSec programme for Flagstone and report back on its success to relevant stakeholders including leadership
• Formalise a secure development lifecycle which includes owning threat modelling and secure design review for new features and systems, working directly with engineering teams during design rather than after the fact, introducing security gates and guardrails and ensuring applications are secure even post deployment
• Run and continuously improve secure code review practices, including SAST/DAST/SCA tooling integrated into CI/CD pipelines and code review (manual and/or AI assisted)
• Coordinate external and execute internal penetration test engagements — scope, logistics, findings triage — and drive remediation to closure with engineering teams
• Maintain and evolve secure coding standards, and run a security champions programme to scale AppSec practice across engineering
• Track and report on vulnerability management across the application estate, prioritising by exploitability and business impact
• Contribute AppSec expertise to incident response where application-layer issues are involved
• Run and own a security champions programme
• Manage application cyber risk according to the internal Flagstone Risk Framework

Job description

Flagstone is recruiting a Senior Application Security Engineer to own AppSec end-to-end across the development lifecycle. You will partner with product engineering teams to embed security from design through deployment, not as an afterthought.

In this hands-on role, you will lead threat modelling, secure design reviews, and secure coding practices, while building scalable security programs, champions, and risk management across the application estate.