Senior Software Security Engineer — Cloud & SDLC Leader

Nothing; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

Nothing is seeking an experienced security engineer in London to own security across backend services and cloud platforms. You will define secure development standards, integrate SAST/DAST/SBOM into pipelines, and drive vulnerability management with engineering teams.

You’ll design security testing, collaborate with privacy and legal, and lead threat modelling using AI to simulate attacks and build defences. This is a full-time London-based role with office presence.

Qualifications

• 6+ years in application security, including security architecture you’ve designed for commercial products and services.
• Deep threat modelling expertise with methodology definition.
• Hands-on cloud security across AWS, GCP, Azure, with secure backend services at scale.
• Proficiency with SAST, DAST, SBOM and knowing which findings matter.
• Experience applying AI or LLMs to security: simulating threats and building countermeasures.
• Solid cryptography and identity fundamentals (TLS, OAuth 2.0, SSO, token management); production-quality code in at least two languages.
• Ability to own a domain end-to-end and communicate across engineers and lawyers.

Responsibilities

• Own security lifecycle and secure architecture for backend services and cloud platforms, from design to live operations.
• Define secure development standards and wire SAST, DAST and SBOM tooling into how we ship.
• Own vulnerability management end to end: find issues, triage findings, and drive engineering teams to closure.
• Design our security testing, from penetration testing to fuzzing, and build tools other engineers can run without you.
• Ship network and server-side and data protection: API security, WAF, gateways, runtime defences, encryption in transit and at rest.
• Partner with our mobile, OS and desktop teams on client-side security tactics and strategy.
• Collaborate with our privacy and legal functions to help us engineer solutions to our global regulatory requirements focusing on emergent technologies such as AI
• Lead threat modelling across authentication, data protection and input handling. Use AI and LLMs to simulate attacks before they happen, then collaborate with the various teams to build the defences.

Skills

Application security

Threat modelling

Cloud security

Secure SDLC

AI in security

Cryptography & identity

Python

Go

Java

C++

Tools

AWS

GCP

Azure

Job description

Nothing is seeking an experienced security engineer in London to own security across backend services and cloud platforms. You will define secure development standards, integrate SAST/DAST/SBOM into pipelines, and drive vulnerability management with engineering teams.

You’ll design security testing, collaborate with privacy and legal, and lead threat modelling using AI to simulate attacks and build defences. This is a full-time London-based role with office presence.