Threat Modelling & App Security Engineer — Remote Contract

Sanderson; Greater London; Hybrid; GBP 101,000 - 120,000; Full time

Job summary

Sanderson in the United Kingdom is seeking an experienced Security Engineer/Consultant on a contract basis to embed within engineering tribes. The role focuses on threat modelling and guidance across the SDLC to ensure secure by design products.

You will conduct threat models for new and existing products and help developers mitigate threats during development. The contract runs for an initial 6 months with an outside IR35 rate of £550–£650 per day and a location mix of Bristol or London (with

Qualifications

• Significant threat modelling experience with IriusRisk or similar tools.
• Deep knowledge of OWASP standards and web application security.
• Experience with DevSecOps and CI/CD security integration.
• Familiar with secure SDLC in agile environments.
• Experience in vulnerability management.
• Ability to communicate security risks to technical and non-technical stakeholders.

Responsibilities

• Conduct and document threat models across products and services, from initial design through to delivery.
• Work with development teams to mitigate identified threats during development.
• Provide security consultancy and guidance to engineers, product owners and architects.
• Embed secure development practices across the SDLC and support the adoption of DevSecOps.
• Support application security activities, including secure design reviews and security testing.
• Manage and improve vulnerability management processes, supporting teams with prioritisation and remediation.
• Produce threat modelling diagrams and supporting documentation for use by delivery teams.
• Support the development of security knowledge within engineering teams.

Skills

Threat modelling

Application security

DevSecOps

Secure SDLC

Vulnerability management

Communication

Tools

IriusRisk

Kubernetes

Job description

Sanderson in the United Kingdom is seeking an experienced Security Engineer/Consultant on a contract basis to embed within engineering tribes. The role focuses on threat modelling and guidance across the SDLC to ensure secure by design products.

You will conduct threat models for new and existing products and help developers mitigate threats during development. The contract runs for an initial 6 months with an outside IR35 rate of £550–£650 per day and a location mix of Bristol or London (with