Find a job 
Featured Companies 
Featured Universities 
For Companies At a Glance
- Tasks: Join agile teams to embed security in software delivery and conduct hands-on threat modelling.
- Company: Sanderson G&D is a fast-growing Cyber Security consultancy focused on secure digital services for the UK Government.
- Benefits: Enjoy remote work options, significant autonomy, and long-term career progression in a supportive environment.
- Why this job: Make a real-world impact by shaping the security of vital digital services while influencing team culture.
- Qualifications: Hands-on experience in application and cloud security, with proficiency in Python and familiarity with CI/CD environments.
- Other info: Must hold active SC clearance; this role offers a unique opportunity to lead security best practices.
The predicted salary is between 48000 - 84000 £ per year.
Sanderson G&D are working with a fast growing Cyber Security consultancy delivering secure, user-focused digital services for the UK Government. They’re looking for an experienced Application Security / DevSecOps Engineer to embed security at the heart of modern software delivery.
This is a newly defined role focused on integrating security into the software development lifecycle (SDLC). You’ll play a critical part in shifting security left, guiding engineering teams, testing controls, and supporting secure design across a range of digital services.
The Role
This is far more than just an AppSec testing role. You’ll be embedded into agile product teams, helping them design and build secure digital services from the ground up.
Your day-to-day might include:
- Conducting hands-on threat modelling and secure design reviews
- Testing APIs and infrastructure manually and with tools like Burp Suite, ZAP, and Nessus
- Driving secure-by-design principles across CI/CD pipelines
- Working across cloud-native platforms (AWS, Azure) and tooling (GitHub, Python, etc.)
- Collaborating with platform and DevOps teams to harden cloud environments
- Supporting the integration of security data into a centralised platform (Splunk) and developing dashboards to visualise risk across services
You’ll be a key player in embedding AppSec into a fast-moving digital environment with tangible real-world impact.
What We’re Looking For
- Hands-on expertise in application and cloud security within CI/CD environments
- Deep understanding of cyber-attack methodologies, threat modelling, and security controls
- Experience security testing APIs and infrastructure – both manually and using automated tools
- Familiarity with Splunk (or a willingness to learn) for visualising service-level risk and posture
- Ability to engage engineering teams in practical, developer-friendly ways
- Proficient in Python or a similar language and confident using developer tooling like GitHub
Why This Role?
- High-impact work shaping the security of digital services that matter
- Significant autonomy and opportunity to lead security best practices across teams
- Opportunity to influence tooling, process, and culture
- Remote working with limited travel
- Long-term progression in a growing, supportive business
Security Clearance: Must hold active SC clearance
Want to shape how modern digital services are secured?
Apply now or get in touch for a confidential chat.
DevSecOps Engineer employer: Sanderson Government & Defence
Contact Detail:
Sanderson Government & Defence Recruiting Team
StudySmarter Expert Advice 🤫
We think this is how you could land DevSecOps Engineer
✨Tip Number 1
Familiarise yourself with the specific tools mentioned in the job description, such as Burp Suite, ZAP, and Nessus. Having hands-on experience or even a solid understanding of these tools will help you stand out during discussions with the hiring team.
✨Tip Number 2
Brush up on your knowledge of cloud-native platforms like AWS and Azure. Being able to discuss your experience or understanding of these environments will demonstrate your readiness to work in a modern DevSecOps role.
✨Tip Number 3
Prepare to showcase your ability to engage with engineering teams effectively. Think of examples where you've successfully communicated security principles in a developer-friendly manner, as this is crucial for the role.
✨Tip Number 4
Since the role requires active SC clearance, ensure that you are aware of the requirements and processes involved in obtaining or maintaining this clearance. Being proactive about this can show your commitment to the position.
We think you need these skills to ace DevSecOps Engineer
Some tips for your application 🫡
Tailor Your CV: Make sure your CV highlights relevant experience in application security and DevSecOps. Focus on your hands-on expertise with CI/CD environments, cloud security, and any specific tools mentioned in the job description, like Burp Suite or Splunk.
Craft a Compelling Cover Letter: In your cover letter, express your passion for embedding security into the software development lifecycle. Mention specific projects where you've successfully integrated security practices and how you can contribute to the company's mission of delivering secure digital services.
Showcase Technical Skills: Clearly outline your technical skills related to the role, such as proficiency in Python, experience with threat modelling, and familiarity with security testing tools. Use concrete examples to demonstrate your capabilities and how they align with the job requirements.
Highlight Collaboration Experience: Since the role involves working closely with engineering teams, emphasise your experience in collaborative environments. Share examples of how you've engaged with developers to promote secure design principles and improve security practices within agile teams.
How to prepare for a job interview at Sanderson Government & Defence
✨Showcase Your Technical Skills
Be prepared to discuss your hands-on experience with application and cloud security, especially within CI/CD environments. Highlight specific tools you've used, such as Burp Suite or ZAP, and be ready to explain how you've applied them in real-world scenarios.
✨Understand the Role of Security in SDLC
Demonstrate your understanding of integrating security into the software development lifecycle. Discuss how you can shift security left and provide examples of how you've guided engineering teams in secure design practices.
✨Engage with Practical Examples
Prepare to share practical examples of threat modelling and security testing you've conducted. This could include discussing specific vulnerabilities you've identified and how you communicated these to development teams in a developer-friendly manner.
✨Familiarity with Tools and Technologies
Make sure to mention your proficiency in Python or similar languages, as well as your experience with GitHub. If you're familiar with Splunk, discuss how you've used it to visualise risk, or express your willingness to learn if you haven't worked with it yet.
