Lead Application Security Engineer

Location: London (2-3 days in the office)

Salary: £100,000 – £120,000 + annual discretionary bonus

(Sponsorship not provided)

Our client, a global strategic advisory firm, is looking for a Lead Application Security Engineer to shape how security is built into the way it designs, develops and delivers technology.

The role starts as a senior individual-contributor position with a genuine chance to build something. You'll establish the firm's application security capability: its standards, review processes and guardrails. You'll also help define what the function needs as it grows, potentially including future team members.

You'll work closely with ICT, AI Engineering, application owners and business stakeholders. The scope covers internally developed applications, APIs, integrations, cloud services, SaaS platforms and selected AI-enabled workstreams. It suits someone who leads through technical credibility and influence rather than by owning every implementation themselves.

Key Responsibilities

• Lead the development of the firm's application security capability: standards, secure design patterns, review processes and practical guardrails that let delivery teams move at pace.
• Review application designs, architecture decisions, APIs, integrations and deployment patterns, so risks are identified early in the delivery lifecycle.
• Lead threat modelling, using STRIDE or similar, for internally developed applications, integrations, automation and AI-enabled workflows.
• Guide secure SDLC practice: security requirements, design and code review, dependency and secrets management, security testing and release assurance.
• Review CI/CD pipelines, infrastructure as code, containerised workloads and cloud infrastructure, and define practical controls for engineering and platform teams.
• Assess third-party platforms, SaaS solutions and new technology features, including AI-enabled tools where there are material application, integration or data security considerations.
• Oversee security assurance, including penetration testing, application security testing and remediation tracking, and drive agreed remediation with the relevant owning teams.
• Define and document security requirements, architecture decisions and risk-based recommendations.

Skills & Experience

• Substantial experience (typically 7+ years) in application security, DevSecOps, cloud security or security engineering. This should include time as a senior technical lead or adviser, with clear examples of reviews, standards and decisions you personally drove.
• Experience working alongside software engineering, DevOps and platform teams to secure applications throughout the delivery lifecycle.
• Strong secure SDLC knowledge: threat modelling, secure design, API security, authentication and authorisation, secrets and dependency management, security testing and remediation planning.
• Practical experience reviewing application architectures, CI/CD pipelines, containers or infrastructure as code.
• Working knowledge of Azure application security controls (Entra ID, managed identities, Key Vault, API Management, container security, logging and secure configuration), alongside Microsoft 365 and SaaS platforms.
• Experience creating security standards, patterns or review processes that engineering teams actually adopt.
• Sound risk judgement, including knowing when compensating controls are appropriate, and the ability to explain technical risk clearly to non-technical stakeholders.
• Familiarity with AI-enabled applications and their risks, such as data exposure, prompt injection, insecure integrations and excessive agent permissions.
• Experience in an ISO 27001-aligned or regulated environment.
• Certifications such as CSSLP, CISSP, CCSP, GIAC or Azure security certifications. Equivalent experience counts just as much.

Why it's worth a conversation

• You'll build an application security capability, and help shape its team, rather than inherit one.
• You'll have influence across a broad, modern technology estate, including the firm's growing AI engineering work.
• The firm is collegiate and intellectually curious, with a strong benefits package and discretionary bonus.

Sure Commercial Limited (trading as Sure Exec Search) is a proud Equal Opportunities employer and does not discriminate against any candidate on the grounds of age, disability, sex, gender identity, sexual orientation, pregnancy and maternity, race, religion or belief, marriage and civil partnerships, or other applicable legally protected characteristics. Our Diversity, Equity, and Inclusion Policy is available on request.

#J-18808-Ljbffr

Full job description from WhatJobs. Apply for this role →