Senior Application & Product Security Engineer
About the Opportunity
We are exclusively partnering with scaling technology platforms across London looking to expand their dedicated Product & Application Security engineering capabilities.
This is not a traditional IT compliance or audit position. You will not be isolated in a security silo generating spreadsheet reports or managing ticket backlogs. Instead, you will embed directly with core engineering squads to design resilient systems, audit microservices, and build automated guardrails that empower developers to ship code rapidly and securely.
Key Responsibilities
- Threat Modeling & Architectural Reviews: Partner directly with backend squads before code is committed to review distributed system designs, identify architectural flaws, and establish secure design patterns.
- Code Audits & Remediation: Inspect pull requests and repositories across modern backend codebases (Go, Python, Java) to triage, explain, and help patch business logic bugs and complex vulnerabilities.
- Automated CI/CD Guardrails: Design, implement, and fine-tune developer-friendly security scanning tooling (SAST, DAST, SCA, dependency analysis) inside modern deployment pipelines (GitHub Actions, GitLab CI).
- API & Authentication Security: Ensure resilient implementation of OAuth2/OIDC, session handling, rate-limiting, and access controls across microservices and external interfaces.
Profile Requirements
- Software Foundation: Demonstrable background in software development or the practical ability to read, debug, and review production code in at least one modern language (Go, Python, or Java).
- Application Security Fundamentals: Strong command of the OWASP Top 10, common exploit mechanics, API security vulnerabilities, and secure SDLC principles.
- Threat Modelling: Practical experience conducting threat modelling exercises on real-world system designs alongside software architects.
- Tooling Automation: Hands-on experience integrating or customizing modern AppSec tooling (e.g., Semgrep, Snyk, Trivy, Dependabot, or similar alternatives).
- Cloud & Container Concepts: Solid grounding in cloud-native deployment patterns (AWS or GCP) and containerization fundamentals (Docker, Kubernetes).
Application & Product Security Engineer employer: Morgan McKinley
As a leading international savings and investments business with over a century of experience, we pride ourselves on fostering a supportive and inclusive work environment that prioritises employee well-being and professional growth. Our flexible working arrangements and commitment to workplace accommodations ensure that you can thrive in your role as the Group Financial Crime Policy and Standards Manager, while contributing to our mission of delivering exceptional financial outcomes for our clients. Join us to be part of a dynamic team that values collaboration, innovation, and integrity in the financial sector.
