76 to 100 of 124 Static Application Security Testing Jobs in the UK

organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. … With a combination of industry-leading tools, services, and expertise, only Black Duck helps organizations maximize security and quality in DevSecOps and throughout the software development life cycle. DevOps Engineer will be a key member of the Cloud Operations team responsible for developing SaaS and Hosted services across ...

level DevOps Engineer to help operate and evolve our AWS-based infrastructure. You’ll work at the intersection of infrastructure automation, application delivery, database operations, and security — using Terraform and GitOps workflows to manage cloud resources, GitHub Actions to power CI/CD, and Python to build … observability across infrastructure and applications (metrics, logs, traces, dashboards, and alerting). Apply DevSecOps practices by embedding security checks into the development lifecycle (SAST/DAST, dependency scanning, container/image scanning, IaC scanning) rather than treating security as a separate gate. Contribute to a cloud security ...

inclusive employer and a member of myGwork – the largest global platform for the LGBTQ+ business community. Please do not contact the recruiter directly. Senior Security Engineer Location: London (Hybrid) | Practice Area : Technology & Engineering | Type: Permanent Lead advanced security engineering initiatives that safeguard the future of digital finance … controls and frameworks, using approved AI and automation where appropriate to improve security outcomes Embed security controls into CI/CD pipelines (SAST, SCA, DAST, container scanning) and enable secure SDLC practices Collaborate across teams to champion secure development practices and responsible use of AI-enabled security ...

inclusive employer and a member of myGwork – the largest global platform for the LGBTQ+ business community. Please do not contact the recruiter directly. Principal Security Engineer Location: London (Hybrid) | Practice Area : Technology & Engineering | Type: Permanent Lead advanced security engineering initiatives that safeguard the future of digital finance … controls and frameworks, using approved AI and automation where appropriate to improve security outcomes Embed security controls into CI/CD pipelines (SAST, SCA, DAST, container scanning) and enable secure SDLC practices Collaborate across teams to champion secure development practices and responsible use of AI-enabled security ...

managed identity patterns, and network segmentation with Private Link, Azure Firewall and WAF rules. Deliver the DevSecOps tooling in GitHub Actions or Azure Pipelines: SAST, SCA, secrets, container and IaC scanning, with tuned rules, reusable pipeline templates and feedback developers can act on. Implement supply chain controls: SBOM generation, artifact … Cloud, Key Vault, and networking with NSGs, Private Link, Azure Firewall and WAF. DevSecOps tooling in GitHub Actions or Azure Pipelines: integrating and tuning SAST, SCA, secrets, container and IaC scanners, and building reusable pipeline templates. Infrastructure as code with Terraform or Bicep, and PowerShell or Python to automate controls ...

dependencies, build agents, artefact repositories and target environments Migrating applications from legacy deployment tooling onto Octopus Deploy Defining and embedding pipeline security controls - SAST, SCA, dependency scanning, secrets detection and artefact scanning (GitHub CodeQL, Dependabot, JFrog Xray and Curation) Managing software supply-chain controls: approved repositories, open-source governance … working knowledge of Bash/shell scripting Good understanding of Git workflows, artefact repositories, package versioning and environment promotion Experience implementing secure coding controls (SAST, SCA, secrets detection) and a good grasp of secure development principles, including authentication, secrets management, certificates and TLS Windows Server and on-premises hosting knowledge ...

Security Engineer (DevSecOps) Rate - £550 - £650 Inside IR35 Duration - 6 months initial Location - London once a week on site Reports to: Head of Security Architecture and Engineering The role: This is a hands-on engineering role focused on building security into software as developed and deployed. … platform engineering with a strong security focus, or in security engineering. Experience with CI/CD and security scanning tools (SAST, SCA, secrets, IaC and container scanning). Python or Bash and Terraform. AWS fundamentals including IAM, plus working knowledge of containers and Kubernetes. A good grasp ...

Engineering (40%) Design and implement Azure landing zones, management groups, and subscription architecture Build and maintain hub‐spoke network topologies with proper segmentation and security controls Implement Azure Policy, RBAC, and governance frameworks that balance security with developer productivity Manage identity and access using Entra ID, service principals … developer platform Build CI/CD pipelines in Azure DevOps or GitHub Actions with proper security scanning Implement shift‐left security: SAST/DAST, dependency scanning, infrastructure scanning, secrets management Establish infrastructure‐as‐code standards with Terraform (or Bicep), including modules and policy enforcement Create self‐service tooling ...

/CD: Build and maintain GitLab CI pipelines: artifact management, environment promotion, and safe deployment strategies (blue/green, canary, rollback), with policy and security checks baked in. Developer Experience & Automation: Identify toil and remove it with Python, Go, or Bash tooling; improve self-service for product development squads … credentials never end up in code or pipelines. Guardrails in Delivery: Contribute to policy-as-code across Terraform and security scanning (SCA/SAST, container image scanning) in GitLab pipelines, working alongside our Security function. Security Reviews: Consider security during design, raise implications explicitly, and contribute ...

across complex enterprise transformation programmes. This role will play a critical part in shaping cloud architecture, driving DevSecOps adoption, and ensuring technology solutions meet security, reliability, and regulatory requirements within a fast-paced delivery environment. Key Responsibilities Define and govern enterprise-scale Azure cloud and DevOps architecture standards across … Redis or Hazelcast. Expertise in API architecture, RESTful services, OpenAPI/Swagger standards, and integration design patterns. Demonstrated experience implementing DevSecOps controls, including SAST, DAST, secrets management, and compliance automation. Excellent stakeholder management, technical communication, and documentation skills. Bachelor's degree in Computer Science, Engineering, Information Technology, or a related ...

across complex enterprise transformation programmes. This role will play a critical part in shaping cloud architecture, driving DevSecOps adoption, and ensuring technology solutions meet security, reliability, and regulatory requirements within a fast-paced delivery environment. Key Responsibilities Define and govern enterprise-scale Azure cloud and DevOps architecture standards across … Redis or Hazelcast. Expertise in API architecture, RESTful services, OpenAPI/Swagger standards, and integration design patterns. Demonstrated experience implementing DevSecOps controls, including SAST, DAST, secrets management, and compliance automation. Excellent stakeholder management, technical communication, and documentation skills. Bachelor's degree in Computer Science, Engineering, Information Technology, or a related ...

organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. ...

services onto standard pipelines and platform blueprints; DevSecOps & Supply Chain Security: Implement and tune security controls embedded in pipelines, including SAST, DAST, and SCA Container and image scanning, IaC security and policy checks, SBOM generation and verification; Implement secure software supply chain practices, including provenance, artifact signing … orchestration. Strong Infrastructure‐as‐Code skills, particularly Terraform. Working knowledge of cloud networking, identity, and secrets management. Security & Compliance: Hands‐on experience integrating SAST, DAST, and SCA tools (e.g., SonarQube, Black Duck, or similar) into pipelines. Experience with container, cloud, and IaC security scanning. Familiarity with policy ...

Lead Application Security Engineer in the UK. You will shape secure-by-design practices across development teams, guiding tooling like SCA/SAST/DAST, container security and automation to strengthen our cyber posture. You will lead engineers, collaborate with product and compliance, and drive secure practices ...

alert: The DevSecOps architect will enable delivery of: A published, adopted paved-road pipeline with a measurable proportion of the estate migrated onto it. Security controls automated into the pipeline with audit evidence generated automatically. Test automation strategy implementation, with coverage and gate compliance reported per release train. Governed … shift-left testing and service virtualisation to reduce dependency on scarce integrated environments. Security integration: Embed security controls into the pipeline: SAST, DAST, SCA, container and IaC scanning, secrets detection, and SBOM generation. Design the software supply chain security model — artefact provenance, signing, dependency governance, base ...

load for engineering teams, and improve release velocity. What You’ll Do Design, develop, and maintain CI/CD pipelines to automate software builds, testing, and releases. Build and maintain internal tooling to support the software development lifecycle (e.g., code quality analysis, dependency management, automated testing). Collaborate … coding assistants to accelerate authoring of CI/CD pipeline configurations, IaC scripts, and automation tooling. Apply AI-assisted security scanning (SAST) as an automated merge gate across engineering pipelines. Support delivery teams and partners to reduce the complexity of implementing IQGeo solutions. Participate in an on-call rotation. ...

Nothing, a London-based technology company, is seeking an experienced application security leader to own the security lifecycle for our backend services and cloud platforms. You will define … secure development standards and guide teams to build defensible architectures without slowing delivery. Lead threat modelling across authentication, data protection and public interfaces, implement SAST/DAST/SBOM tooling, and drive encryption and runtime defenses. #J-18808-Ljbffr ...

Halfords is seeking an Application Security Lead to own and shape the security capability across a diverse technology estate. You will work with development, architecture, product owners, and third parties to embed secure-by-design … principles and ensure appropriate controls are built into delivery processes. This role requires threat modelling, security design reviews, and hands-on tooling across SAST, DAST, and SCA. #J-18808-Ljbffr ...

Develop and maintain Infrastructure as Code (Terraform, YAML or equivalent). Automate deployment, configuration and operational processes to enable secure and repeatable releases. Embed security controls throughout the software development lifecycle (SDLC). Implement and maintain CI/CD pipelines, including security scanning and compliance checks. Manage platform … teams. Experience deploying and managing infrastructure using Terraform. Experience building and deploying containerised applications. Experience implementing application and infrastructure monitoring solutions. Experience with SAST, DAST and software supply chain security tooling (e.g. SonarQube, Trivy). Experience with on-premises DevOps toolchains and platforms. This role will require ...

comfortable engaging with clients, understanding their needs, and translating them into effective outcomes. The Role: We are seeking a highly skilled and motivated Security Cleared DevOps Engineer to join our team. The successful candidate will be responsible for designing, implementing, and maintaining secure, scalable, and automated infrastructure solutions across … Cloud Build, Artifact Registry and Cloud Deploy. Knowledge of GitOps practices and tools such as Argo CD or Flux. Experience implementing DevSecOps tooling, including SAST, DAST, container image scanning and dependency scanning. Familiarity with policy-as-code, automated compliance and security controls. Experience working in regulated, government, defence ...

youre comfortable engaging with clients, understanding their needs, and translating them into effective outcomes. The Role: We are seeking a highly skilled and motivated Security Cleared DevOps Engineer to join our team. The successful candidate will be responsible for designing, implementing, and maintaining secure, scalable, and automated infrastructure solutions … Cloud Build, Artifact Registry and Cloud Deploy. Knowledge of GitOps practices and tools such as Argo CD or Flux. Experience implementing DevSecOps tooling, including SAST, DAST, container image scanning and dependency scanning. Familiarity with policy-as-code, automated compliance and security controls. Experience working in regulated, government, defence ...

directly into release decisions. Drive shift-left testing, service virtualisation and greater automation across complex engineering environments. Embed automated security controls including SAST, DAST, SCA, container/IaC scanning, secrets detection and SBOM generation into delivery pipelines. Establish policy-as-code, software supply chain security and automated … such as Selenium, Playwright, Cypress, JUnit/pytest, Pact, JMeter or k6. Deep practical experience integrating security controls into CI/CD, including SAST/DAST/SCA, secrets management and software supply chain security. Strong experience across Azure DevOps, GitHub Actions, GitLab and/or Jenkins, alongside Kubernetes ...

Redgate is seeking a senior security engineer to embed security deeply into our product teams, defining requirements across the SDLC and leading threat modelling for new features. You’ll influence architecture, guardrails, and secure … default patterns, balancing risk with delivery velocity. Work across engineering and product squads in a hybrid role based in Cambridge. You’ll champion SAST/DAST, support AI security initiatives, and translate security findings into pragmatic engineering work #J-18808-Ljbffr ...

identifying bottlenecks in the secure software development lifecycle and building automated solutions to resolve them. Architecting and evolving standardized deployment patterns that bake in security, compliance, and observability, allowing product teams to focus on delivering customer functionality. Ensuring high availability, performance, and seamless integration of our self-hosted engineering … modern deployment methodologies (such as GitOps) to ensure declarative, reproducible, and audited state management across all environments. Owning automated security tooling (e.g. SAST, DAST, dependency scanning, container scanning, and secrets detection) to deliver security audit evidence for the platform Arondite aims to bring together individuals from diverse backgrounds ...

properly: IAM, service accounts, logging and org policy. AWS and Azure familiarity helps You can read code well enough to judge whether a SAST finding is real You’re genuinely fluent with AI tooling and you build with it rather than around it You write clearly, because most of what … properly: IAM, service accounts, logging and org policy. AWS and Azure familiarity helps You can read code well enough to judge whether a SAST finding is real You’re genuinely fluent with AI tooling and you build with it rather than around it You write clearly, because most of what ...