Application Security Engineer

Overview

In this role you join Rightmove’s growing Application Security function as the first engineering hire, partnering with engineering teams to embed AppSec across tooling, vulnerability management, secure design, and threat modelling. You will influence how the security function matures while delivering practical security controls and risk-based guidance. You’ll collaborate cross-functionally to scale security practices in a fast-moving product environment. This is an impact-driven opportunity to shape risk management for a market-leading platform.

Pay / Benefits

• Private Medical Insurance
• Pension and Life Insurance
• 27 days holiday + volunteering days
• Hybrid working with 2 days in office
• Life assurance 4x salary
• Cycle to work / travel loan options

Responsibilities

• Rollout and operation of application security tooling (SAST, SCA, secrets detection) across engineering repositories
• Triage and classify security findings, drive remediation of secrets backlog
• Operate vulnerability management processes including triage, monitoring, and engineering engagement
• Maintain engineer-facing guidance for resolving vulnerabilities and handling exceptions
• Support cloud security posture management via Prisma Cloud, including triage and engagement with relevant teams
• Run risk-tiered engagements with engineering teams based on SLA compliance
• Triage inbound security requests per AppSec triage SLA
• Conduct secure design and API security reviews for new services, integrations, and RFCs
• Review and respond to penetration test requests and third-party integration reviews
• Facilitate threat modelling sessions using runbooks/guides and improve practices across squads
• Maintain runbooks and process documentation; support recurring reviews (access, vulnerability audits)

Key requirements

• Practical experience in application security or a related security engineering role
• Ability to assess findings in context and recommend pragmatic engineering actions
• Working proficiency in Python (read, modify, and write internal tooling scripts)
• Experience with DAST/SAST/SCA/secrets scanning tools (Aikido, Snyk, Semgrep, Checkmarx, or similar)
• Experience with Prisma Cloud or a comparable cloud-native security platform
• Comfort reading code and understanding CI/CD pipelines (GitLab CI or equivalent)
• Experience running or contributing to threat modelling exercises
• Comfortable running recurring stakeholder syncs with engineering teams
• Strong written communication
• Ability to triage and prioritise high volumes of inbound requests independently

• Strong written communication
• Stakeholder engagement
• Independent prioritization
• Python scripting
• SAST/DAST/SCA/secrets scanning tools (Aikido, Snyk, Semgrep, Checkmarx)
• Prisma Cloud or similar cloud-native security platform

Full job description from WhatJobs. Apply for this role →