Application security engineer in medical research

TipTopJob; United States; Hybrid; USD 96,000 - 117,000; Full time

Benefits offered by this job

Remote/hybrid

London office

Full-time permanent

Benefits package

Job summary

TipTopJob is seeking an Application Security/DevSecOps specialist with hands-on SDLC security integration to join a well-established health research charity. You will collaborate with engineering, architecture and cloud teams to embed security across the software development lifecycle.

You will implement security testing, CI/CD security controls, API/security design guidance, and secure cloud infrastructure in Azure AKS, driving security-as-code and threat modelling while enabling development

Qualifications

• Hands-on experience embedding application security into the SDLC.
• Experience with Microsoft Azure security controls and cloud security governance.
• Experience with KQL.
• Experience securing APIs, internet-facing services, Kubernetes (preferably AKS), and containerised environments.
• Experience with SAST, DAST, IAST and SCA.
• Knowledge of security automation, security/policy-as-code and secure engineering practices.
• Familiarity with GitHub and GitHub Actions.
• Experience with Terraform and Python.
• Understanding of cloud security governance.
• Experience with threat modelling in software engineering contexts.
• Knowledge of ISO 27001 and its relevance to secure engineering.
• Exposure to Agile working environments and DevSecOps practices.
• Eligible to work in the UK.

Responsibilities

• Promote secure development with engineering and architecture teams.
• Implement and maintain application security testing solutions.
• Integrate security controls into CI/CD pipelines.
• Strengthen the security of GitHub Actions and similar CI/CD platforms.
• Provide guidance on secure API design and externally accessible systems.
• Support Azure cloud infrastructure, including AKS.
• Develop security-as-code and policy-as-code.
• Support the security of cloud-hosted data platforms.
• Automate security processes through infrastructure-as-code and scripting.
• Maintain security documentation.
• Support development teams with security tooling and best practices.
• Contribute to threat modelling and compliance activities.

Skills

Secure SDLC

Azure security controls

KQL

API security

SAST DAST IAST SCA

Security automation

GitHub Actions

Terraform

Python

Threat modelling

ISO 27001

DevSecOps

Agile

UK work eligibility

Tools

GitHub

Kubernetes

AKS

Job description

Описание

Do you have a background in Application Security, DevSecOps or Product Security, with hands:on experience embedding application security into the SDLC? If so, this could be an opportunity worth considering.Join a well:established health research organisation and charity supporting large:scale medical research. You will work closely with engineering, architecture and cloud teams to integrate security throughout the software development lifecycle.

Задачи

• Working with engineering and architecture teams to promote secure development.
• Implementing and maintaining application security testing solutions.
• Integrating security controls into CI/CD pipelines.
• Strengthening the security of GitHub Actions and similar CI/CD platforms.
• Providing guidance on secure API design and externally accessible systems.
• Supporting Azure cloud infrastructure, including Azure Kubernetes Service (AKS).
• Developing security:as:code and policy:as:code.
• Supporting the security of cloud:hosted data platforms.
• Automating security processes through infrastructure:as:code and scripting.
• Maintaining technical and security documentation.
• Supporting development teams with security tooling and best practices.
• Contributing to threat modelling and compliance activities.

Требования

• Hands:on experience embedding application security into the SDLC.
• Experience with Microsoft Azure security controls and cloud security governance.
• Experience with KQL.
• Experience securing APIs, internet:facing services, Kubernetes, preferably AKS, and containerised environments.
• Experience with SAST, DAST, IAST and SCA.
• Knowledge of security automation, security:/policy:as:code and secure engineering practices.
• Familiarity with GitHub and GitHub Actions.
• Experience with Terraform and Python.
• Understanding of cloud security governance.
• Experience with threat modelling in software engineering contexts.
• Knowledge of ISO 27001 and its relevance to secure engineering.
• Exposure to Agile working environments and DevSecOps practices.
• Eligible to work in the UK.

Будет плюсом

• Ideally experience securing data platforms such as Databricks, Dagster or Snowflake

Условия

• A GBP 80,000 DOE, negotiable
• Predominantly remote / hybrid working London office
• Full:time permanent position
• Excellent benefits package