Application Security Engineer - AppSec/DevSecOps

WNTD is seeking an Application Security Engineer for a six-month contract supporting a global investment management organisation in London.

This hands-on role combines application security, secure software development and DevSecOps. You will work closely with developers to identify and resolve vulnerabilities, automate security services and embed security throughout the software development life cycle.

The role also requires practical experience using AI models and security evaluation tools to assess application code.

Key responsibilities

• Embed secure software development life cycle (SSDLC) practices across technology projects.

• Build and maintain application security tools, services and automation scripts.

• Integrate security testing into CI/CD pipelines and support development teams using Azure DevOps.

• Operate and improve static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA) and infrastructure-as-code (IaC) security tooling.

• Use approved AI models and security evaluation harnesses to identify code vulnerabilities, business logic weaknesses and misconfigurations.

• Help developers interpret penetration testing findings, prioritise vulnerabilities and implement fixes.

• Conduct threat modelling and provide guidance on secure design, coding, access management and data protection.

• Improve security tooling coverage across Azure and AWS environments, alongside WAF or IDS capabilities.

• Test security products and communicate application security risks to technical and business stakeholders.

Essential skills and experience

• Strong hands-on Application Security/AppSec experience, supported by an application or web development background.

• Ability to code in at least one language, such as Python, JavaScript, C# or PowerShell.

• Experience with Azure DevOps, CI/CD pipelines, security automation and secure software delivery.

• Practical experience with application security scanning tools, vulnerability triage and remediation.

• Strong understanding of OWASP Top 10, common software weaknesses, threat modelling and secure coding.

• Previous use of AI models and security evaluation harnesses to assess application or software code.

• Experience with GitHub and AI coding/security tools such as Copilot or Codex, alongside awareness of OWASP Top 10 for Agentic AI.

• Ability to work collaboratively with developers and explain complex security findings clearly.

• A Computer Science/Cyber Security degree and a relevant certification such as CISSP, CSSLP, CEH, OSCP or similar.

Desirable experience

• Financial services or another large enterprise environment.

• Cloud security tooling across Microsoft Azure and/or AWS.

• Web Application Firewalls (WAF) or Intrusion Detection Systems (IDS).

• Technical leadership and mentoring within application security.

Location: London - hybrid, three days per week in the office

Contract: Six months

Start: ASAP

IR35: Inside IR35