Senior Security Engineer (Application Security)

Crane Venture Partners; Greater London; On-site; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Competitive salary

Equity in high-growth startup

London office 4+ days/week

25 days annual leave

Learning & development budget

Travel for customer visits

Daily company lunches

Team socials & offsites

Job summary

Encord is seeking a Lead Security Engineer to own application security across our platform and embed secure practices throughout the development lifecycle. The role requires 7+ years of hands-on AppSec experience, strong Python/TypeScript coding, and deep web/API security knowledge.

You will secure a cloud-native SaaS with AWS/GCP, Kubernetes, and CI/CD pipelines while mentoring engineers and guiding security strategy across the organization.

Qualifications

• 7+ years in software or security engineering with hands-on AppSec.
• Strong coding ability in Python and/or TypeScript.
• Deep knowledge of web and API security (OWASP Top 10, OAuth/OIDC, authz models).
• Experience securing cloud-native SaaS (GCP or AWS, Kubernetes).
• Track record building security tooling and processes in a fast-moving product company.
• Clear communicator who can influence engineering teams and speak to enterprise customers.

Responsibilities

• Own the application security program end to end: threat modelling, secure design reviews, code review, and vulnerability management.
• Build security into the SDLC with SAST, DAST, dependency/SCA, and secrets scanning integrated into CI/CD without slowing teams down.
• Partner with engineering on authentication, authorization, multi-tenancy isolation, and data protection across our APIs and SDKs.
• Lead penetration testing, bug bounty triage, and incident response for application-layer issues.
• Support customer security reviews and compliance (SOC 2, HIPAA, GDPR) with practical technical controls.
• Mentor engineers and raise the security bar across the organisation.

Skills

Python

TypeScript

AppSec experience

Security tooling

Threat modelling

Tools

AWS

GCP

Kubernetes

CI/CD

SAST tooling

Job description

About us

Encord is the universal data layer for AI that helps 300+ AI teams train and run models on the right data. Our platform indexes, curates, annotates, and evaluates data across the full AI lifecycle, from development through production.

Trusted by Woven by Toyota, AXA, UiPath, Zipline, and more. We're an ambitious team of 100+ working at the frontier of AI and have raised $60M in Series C funding from Wellington Management, CRV, Next47 and Y Combinator.

About the role

As Lead Security Engineer, you'll own application security across our platform, embedding secure practices into how we design, build, and ship software, and setting the direction for a growing security function.

What you'll do

• Own the application security program end to end: threat modelling, secure design reviews, code review, and vulnerability management.

• Build security into the SDLC with SAST, DAST, dependency/SCA, and secrets scanning integrated into CI/CD without slowing teams down.

• Partner with engineering on authentication, authorization, multi-tenancy isolation, and data protection across our APIs and SDKs.

• Lead penetration testing, bug bounty triage, and incident response for application-layer issues.

• Support customer security reviews and compliance (SOC 2, HIPAA, GDPR) with practical technical controls.

• Mentor engineers and raise the security bar across the organisation.

What we're looking for

• 7+ years in software or security engineering, with significant hands‑on AppSec experience.

• Strong coding ability (Python and/or TypeScript ideal) and the credibility to review and fix code, not just flag issues.

• Deep knowledge of web and API security (OWASP Top 10, OAuth/OIDC, authz models, SSRF, injection, deserialisation).

• Experience securing cloud‑native SaaS (GCP or AWS, Kubernetes, containers).

• Track record of building security tooling and processes in a fast‑moving product company.

• Clear communicator who can influence engineering teams and speak to enterprise customers.
  

Nice to have

• Experience with ML/AI systems security (data pipelines, model supply chain, LLM‑specific risks such as prompt injection).

• Background in regulated industries such as healthcare.

• Previous experience as an early or first dedicated security hire.

Why Encord

• Competitive salary, and meaningful equity in a high‑growth startup

• Strong in‑person culture — most of the team works from our London office 4+ days/week

• 25 days annual leave + UK public holidays

• Annual learning & development budget

• Travel for customer visits, events, and conferences across the UK and Europe

• Daily company lunches

• Monthly socials & bi‑annual team offsites

Operating principles

High agency

You see something broken, you fix it or find the person who can. We celebrate the people who solve 90% of a problem before anyone asks.

Build with care & urgency

We bear-hug the customer. Former founders and people from fast‑moving, high‑stakes environments thrive here.

Self‑aware & hungry

We stay warm, self‑aware, and genuinely hungry. We elevate our peers, and ego doesn't last long.

Invent in real time

We move toward the ambiguity. We’re pragmatic, resourceful, energized by the fact that there's no playbook.

If you're looking to do the most meaningful work of your career alongside people who push you to be better, we'd love to meet you.