Built software first. Now you’d rather break it. This one’s for engineers who’ve moved into security, or who are still writing code day to day but have done real security work alongside it. If you’ve shipped production systems, then found yourself running threat models, digging into OWASP and becoming the person your team asks "is this safe?", read on. The problem Most attacks don’t come through the front door. They come through something that was already let in: a dependency, a package, a library that looked legitimate. The software engineers build today is only as secure as everything it quietly pulls in, and AI is making that problem harder by the month. Regulators are watching, enterprise security teams are scrambling, and this company is building the infrastructure to get ahead of it. Why an engineer’s background matters here This isn’t a compliance role or a scanner-babysitting job. You’ll sit with engineering teams as a peer, reviewing designs and code, and building security tooling that has to run in production. People who’vE built and shipped software tend to be best at this, because they understand how systems actually get made and where they actually break. What you’ll do Lead threat modelling and secure design reviews with engineering teams from the start of a project Carry out secure code reviews against OWASP Top 10 and ASVS, and coach engineers to catch issues themselves Own SAST, DAST and SCA, writing the automation and integrations around them Harden APIs, containers, IaC and CI/CD pipelines across a cloud-native AWS stack Run penetration tests and vulnerability assessments across services and infrastructure Act as technical lead during incident response and red/blue exercises Build security tooling from scratch to production standard What you’ll bring A software engineering background: you’ve designed, built and shipped production code, and you still enjoy writing it Solid hands-on security work, whether in a dedicated AppSec role or alongside your engineering job: threat modelling, OWASP, secure code review, vulnerability remediation Around 5+ years in engineering and/or security combined Strong AWS security experience, since the whole platform runs on it Depth with security tooling (which products matters less than how well you know them) Low ego and a collaborative style that suits a small, close-knit team Curiosity. CTFs, bug bounties and home labs are all green flags The package Up to £130,000 depending on experience, plus equity with real upside. The technical founders set up the structure to reward engineers properly, and the company is on an IPO trajectory over the next 3–5 years. You’ll also get 35 days’ annual leave plus your birthday off, fully remote working with flexible hours, a pension matched up to 8%, private medical, dental and optical cover, and paid sick leave, income protection and life insurance. Interested? Drop me a message. Details stay confidential until we’ve spoken. This role isn’t being advertised widely, so if you’re an engineer who’s caught the security bug, it’s worth a conversation.
Senior Application Security Engineer employer: Runtime
Runtime is an exceptional employer that fosters a dynamic and innovative work culture, perfect for those looking to make a significant impact in the tech industry. As a fast-growing startup, we offer unparalleled opportunities for professional growth and development, alongside competitive equity options. Join us in our mission to revolutionise software delivery at scale, where your contributions will be valued and recognised in a collaborative environment.
