As an Application Security Engineer you'll make our software secure by building, not by watching dashboards. You'll spend most of your time in the codebase — reading and writing code, manually reviewing changes, hunting for and exploiting vulnerabilities, and shipping the libraries, patterns, and guardrails that make the next class of bug hard to introduce. You'll work shoulder-to-shoulder with engineers, treating security as an engineering problem to be solved at the source rather than a report to be filed.

Read and write real code. Review pull requests for security-relevant changes and contribute fixes directly rather than filing tickets and walking away. Manually assess applications and APIs — find, exploit, and prove real vulnerabilities, and distinguish genuine risks.

Build secure building blocks: reviewing libraries, safe wrappers, auth patterns, and paved-road templates so the easy way is the secure way. Perform threat modelling and design reviews on new features, working from how the system actually behaves, not a checklist. Automate security into CI/CD (Octopus deploy/Azure DevOps) Fix vulnerabilities; When you find a bug, ask what pattern allowed it and eliminate the pattern.

Support incident investigation and remediation for application security issues and get hands-on with logs, code, and root cause. Level up engineers through code, examples, and quarterly training Help shape standards and priorities for the wider engineering teams (this is a small team; you'll have real influence, but the day job is engineering).

Requirements (E.G., GDPR, ISO 27001)

NET and/or TypeScript/React, and you can drop into an unfamiliar codebase and reason about it. Solid application security experience securing web apps and APIs. Demonstrated ability to find vulnerabilities manually and explain both the exploit and the fix.

Comfortable integrating and, crucially, tuning security testing in CI/CD so the output is trustworthy. You've influenced engineers as a peer, through code and pragmatism. Certifications (Preferred): Offensive/practical certs like OSCP, or an equivalent Cloud security depth in AWS and/or Azure; container/orchestration security.

Familiarity with GDPR, ISO 27001, SOC 2 as constraints to engineer around.