Application Security Engineer

Salary: £60,000 - 100,000 per year

Requirements:

• Strong hands-on experience in application security, with a solid understanding of secure software development, OWASP Top 10, common application vulnerabilities and secure SDLC practices.
• Proficiency in one or more programming languages, such as Python or JavaScript, with experience using code to support security automation, tooling, custom rule development or other ways to make security scale.
• Experience working across cloud platforms such as AWS, Azure or SAP, alongside a good understanding of modern application architectures, container security, API security, network protocols and identity frameworks such as OAuth 2.0, OIDC and SAML.
• Strong working knowledge of DevOps pipelines, repositories and CI/CD security integration, including platforms such as Azure DevOps and GitHub Actions.
• Practical experience with security tooling and practices including SAST, DAST, SCA, container scanning, vulnerability management, SBOM tooling such as CycloneDX, IaC security across Terraform, Bicep, Ansible and tools such as Trivy, plus Policy as Code and threat modelling.
• A proactive, curious and collaborative approach, with the ability to guide engineering teams, support third-party supply chain security and make complex topics feel practical.
• Desirable extras include certifications such as GWAPT, GWEB, OSCP or AWS Security Specialty, Security Champions or developer training experience, and exposure to SOC or Incident Response environments.

Responsibilities:

• Collaborate with DevOps and engineering teams to weave security best practice into the software development lifecycle, helping teams deliver at pace without compromising on protection.
• Provide practical guidance on secure design, implementation and architecture, including API security, microservices patterns and cloud-native application security.
• Carry out ongoing manual security assessments, coordinate third-party engagements where needed, and turn findings into clear, prioritised actions.
• Review SAST, DAST and SCA outputs, driving remediation through to closure and keeping tracking, ownership and prioritisation firmly on course.
• Provide on-demand application security support while driving continuous improvement across processes, tooling and ways of working, making security simpler, smarter and more scalable.
• Lead or contribute to the Security Champions programme and work closely with GSOC and CSIRT teams on application-layer security incidents, helping build a strong, distributed security culture across engineering.

Technologies:

• API
• AWS
• Ansible
• Azure
• CI/CD
• Cloud
• DevOps
• GitHub
• Support
• JavaScript
• Network
• OWASP
• OAuth
• Python
• SAML
• SAP
• Security
• Terraform
• microservices
• DevSecOps

More:

We are a family of brands revolutionising how we power the planet, with 21,000 colleagues working together to create a greener, fairer future and a cleaner energy system. We do energy differently by making it, storing it, moving it, selling it and mending it. This is a UK-based hybrid role with occasional travel to site. We offer a generous market salary, a 15% Employee Energy Allowance, a comprehensive pension plan, fully funded company healthcare, 25 days of holiday plus public holidays with the option to buy up to 5 extra days, and a flexible benefits package that includes tech treats, eco-friendly car leases and travel insurance. We pride ourselves on being a people place, supporting the different realities our people face and offering total rewards designed to support you and your family financially, physically and emotionally.

last updated 40 week of 2026