Senior Application Security Engineer - Product Security & DevSecOps

Requisition ID: 103About UsDuco is on a mission to reduce the time spent on data-related work by 90%. Our enterprise data automation platform empowers teams to work more efficiently and meaningfully by giving them the ability to automate data controls with the latest technology, such as no-code, the cloud, and AI.We help firms to start trusting their data, by giving them one intuitive platform to automate the front-to-back processing of all kinds of data (from structured Excels and RTFs to unstructured PDFs and emails). This eliminates the boring manual work across the data lifecycle and enables firms to act faster, work smarter, save money, reduce risk and comply with regulatory requirements.

We're headquartered in London and have offices in New York, Wroclaw, Singapore, and Antwerp. We're proud to call some of the largest global financial institutions our clients, including over 15 of the world's largest international banks, as well as brokers, exchanges, asset managers, hedge funds, administrators, service providers and corporates.

The opportunityWe are seeking an experienced Senior Application Security Engineer to take ownership of security across our software development lifecycle (SDLC). In this role, you will establish secure delivery as the default for our engineering teams, from design and code through to the pipelines that release it. You will own our Application Security Posture Management (ASPM) platform, Ox Security, and ensure its findings translate into effective remediation. This includes reducing noise, prioritising vulnerabilities that are genuinely exploitable and partnering closely with engineering teams to resolve them. You will also define our approach to threat modelling, security testing and the integration of security guardrails into our CI/CD pipelines.

You will join a small, collaborative Information Security team based across London and Wrocław, working alongside our Senior Security Engineer (Cloud & SecOps) and our Governance, Risk and Compliance (GRC) function. You will work closely with our Engineering teams on a day-to-day basis and report to the Head of Information Security.

Key responsibilitiesSecure SDLC and pipeline securityOwn security across our SDLC and CI/CD pipelines, embedding secure delivery as the defaultBuild and maintain pipeline security guardrails, including static application security testing (SAST), software composition analysis (SCA), secrets scanning, and infrastructure-as-code (IaC) and container image scanning, with gating policies agreed with EngineeringStrengthen software supply chain security, including dependency hygiene, software bills of materials (SBOMs) and build provenanceDefine pre-deployment cloud guardrails through policy-as-code, in partnership with our Senior Security Engineer (Cloud & SecOps)Vulnerability management and remediationOwn Ox Security as our ASPM platform, including policy tuning, noise reduction and the prioritisation of findings based on reachability and exploitabilityDrive remediation with engineering teams, agreeing remediation service level agreements (SLAs) with engineering leads and reporting clearly on progressScope and coordinate application penetration testing, tracking findings through to remediationSecure design and engineering enablementLead threat modelling for new features and significant architectural changesConduct secure design reviews and review high-risk code changesPromote secure coding practices through practical guidance, training and a security champions network across EngineeringClient assurance, reporting and threat awarenessRepresent our platform security with confidence in client security reviews and due diligence discussions, alongside the Head of Information SecurityMaintain and report application security metrics that inform risk reporting and key risk indicators (KRIs)Support audits and client assurance activities with clear evidence of our secure development and release practicesMonitor emerging application and supply chain threats, including those affecting AI and agentic capabilitiesSkills and experienceProven experience in an application security, product security or DevSecOps role, ideally within a SaaS environmentHands-on experience integrating security tooling into CI/CD pipelinesA track record of converting SAST, SCA, secrets or ASPM findings into prioritised, remediated work rather than raw reportingStrong understanding of common vulnerability classes and the OWASP Top 10, with practical knowledge of how to remediate themThe ability to read and review code in at least one of our core languages: Java, Ruby or PythonExperience facilitating threat modelling with engineering teamsWorking knowledge of AWS and infrastructure-as-codeProficiency in Python or a comparable scripting language for automationCredibility with developers, with the ability to influence engineering teams and articulate risk in actionable termsDesirableHands-on experience with Ox Security or another ASPM platformA background in software engineering prior to moving into securitySoftware supply chain security experience, such as Supply-chain Levels for Software Artifacts (SLSA), SBOMs or artefact signingContainer and Kubernetes security experience, including image scanning and admission controlsExperience with policy-as-code toolingExperience establishing a security champions programmeExperience securing large language model (LLM) or agentic AI capabilities, such as applying the OWASP Top 10 for LLM ApplicationsFamiliarity with financial services regulations and standards, such as the Digital Operational Resilience Act (DORA), ISO 27001 and SOC 2Relevant professional certifications, such as OSWE, GWAPT, CSSLP or AWS Certified Security – SpecialtyThe reward packageCompetitive salary package aligned with your skills and experience. Reviewed annually.

Annual Performance-based bonusHealthcare cashback scheme and private medical insurance4X salary life assuranceUnlimited annual holiday, because we trust our people to manage their own time offEnhanced family leaveEmployee Assistance ProgrammeCycle to Work and Tech Scheme4 Volunteering days offFlexible working policy (2 days per week in office)Opportunity to work abroad for up to 6 weeks per yearPersonal learning and development opportunitiesReferral bonus if we hire someone great who you've recommended to usSpot RewardsEmployee of the Month and Employee of the Year awardsWant to do a little more research before you apply?

Head over to our Glassdoor page to learn about our benefits, culture and to find out what our team thinks about life at Duco. You can also find out more about us on LinkedInDisclaimer Because we are committed to inclusivity, we strive to provide equitable opportunities for everyone. If you require accommodation during the recruitment process, please let us know at talent@du.co. Include your contact information, the role you're applying for, and how we can accommodate you.

During the interview process and after hire, Duco does not discriminate on the basis of race, colour, gender or gender expression, sexual orientation, marital or pregnancy status, national origin, age, disability, religion or creed, socioeconomic background or status, size, or any other protected characteristic.