Senior DevSecOps Security Engineer (12-Month Contract)

giffgaff | Certified B Corp; Uxbridge; Hybrid; GBP 90,000 - 120,000; Full time

Job summary

giffgaff is seeking a Senior Application Security Engineer on a 12-month fixed-term contract in Uxbridge. You will embed security into how we design, build and run our products, working across a modern technology estate to ensure secure software from the earliest stages of development through to production.

You will collaborate with engineers, architects and platform teams to identify risks, drive vulnerability remediation, and strengthen our DevSecOps capabilities while coaching teams to

Qualifications

• Experience assessing security impacts across codebases and APIs using languages such as Java, TypeScript and Python.
• Strong knowledge of the OWASP Top 10, secure coding practices, and common web and API vulnerabilities.
• Hands‑on experience triaging, validating and remediating vulnerabilities with both technical and non‑technical stakeholders.
• Experience integrating security tooling into CI/CD pipelines and embedding DevSecOps practices.
• Proven expertise in threat modelling, secure code review, architecture review, and container/Kubernetes security.

Responsibilities

• Embed security into product design, development and operations.
• Collaborate with engineers, architects and platform teams to identify risks and remediation.
• Drive vulnerability remediation and strengthen DevSecOps capabilities.
• Coach teams to foster a strong security culture across the business.

Skills

Java

TypeScript

Python

OWASP Top 10

CI/CD security

DevSecOps

Threat modelling

Container/Kubernetes security

Tools

Terraform

AWS

CI/CD tooling

Job description

giffgaff is seeking a Senior Application Security Engineer on a 12-month fixed-term contract in Uxbridge. You will embed security into how we design, build and run our products, working across a modern technology estate to ensure secure software from the earliest stages of development through to production.

You will collaborate with engineers, architects and platform teams to identify risks, drive vulnerability remediation, and strengthen our DevSecOps capabilities while coaching teams to