Senior Security Engineer (Hiring Immediately)
Policy Expert - Senior Security Engineer We're on a mission to make: The most successful insurance disruptor people want to stay with for life Are you ready to transform the insurance industry with innovative technology? At Policy Expert , we are on a mission to revolutionize Home , Pet , and Motor insurance, making it clear, fair, and great value for customers. Since our inception in 2011, our breakthrough thinking and proprietary tech have won us over 1.5 million customers and the title of the UK's No.1-rated home insurance provider for 9 years . About the DevSecOps team: At Policy Expert, the DevSecOps team focuses on application, cloud, and cybersecurity to ensure security is integrated throughout the software development lifecycle. Our goal is to empower tech teams to build and deploy secure applications and platforms by embedding security best practices, automating security checks, and fostering a culture of shared responsibility. Becoming part of the DevSecOps team means joining a high-impact, forward-thinking group dedicated to securing the business and its customers. Team members collaborate with development, platform, IT, and Compliance teams to mitigate risks, enhance compliance, and enable faster, safer software delivery, ultimately strengthening the organisation's competitive edge and fostering customer trust. Your day to day:
- Lead the application and API security initiatives, ensuring robust protection mechanisms are in place.
- Own and drive the Application Security Posture Management (ASPM) function.
- Integrate security within the plan/design phase through threat modelling, code and architecture reviews, and by defining secure coding standards, libraries, and best practices.
- Configure and manage security tooling such as ASPM, CSPM, IAM/PAM, WAF, including writing custom security rules for the CI/CD pipeline.
- Collaborate with cross-functional teams to drive security improvements and embed a security-first mindset across the organisation.
- Participate in first responder rota where you would be the point of contact for consulting on security queries from development team, reviewing state of security through internal or external threat intelligence, and responding to security alerts.
- Perform and support internal pentesting efforts, identifying and mitigating vulnerabilities in our applications and APIs.
- Proven experience delivering web application and API security improvements across an organisation.
- Proficiency with DevSecOps and SDLC tooling, including SAST, DAST, SCA, ASPM and CSPM.
- Hands-on experience with IAM solutions such as Auth0, or AWS Cognito.
- Strong background in threat modelling and vulnerability management.
- Strong background in AWS, cloud computing concepts, and cloud security best practices.
- Previous experience as a software engineer.
- Experience running a security champion program.
- Knowledge of security incident management and response.
- Relevant certifications such as OSCP, OSWP, CISSP, AWS Security Specialty, or similar.
- 15 minute Chat with someone from our Internal Talent Team.
- 90 minute Technical Interview with our Lead DevSecOps Engineer.
- 60 minute Culture fit interview with Tech Principal of Platform Engineering and non-technical person.
- Company
- Policy Expert
- Location
- London, UK
- Employment Type
- Full-time
- Posted
- Company
- Policy Expert
- Location
- London, UK
- Employment Type
- Full-time
- Posted