Senior Application Security Analyst

Salary: £85,000 - 90,000 per year

Requirements:

• We require 5–8 years of hands-on experience in application security testing.
• We require advanced knowledge of internet and network technologies.
• We require expert understanding of web and API technologies and common vulnerabilities, including OWASP Top 10, API/LLM Top 10, and Mobile Top 10.
• We require advanced mobile security testing experience across Android and iOS, including reverse engineering, runtime manipulation, Frida scripting, and Objection.
• We require advanced knowledge of container orchestration and Kubernetes security, including cluster hardening, RBAC, and workload isolation.
• We require advanced AI/LLM security assessment experience.
• We require expert understanding of security controls such as access control, encryption, logging/monitoring, and secure configuration, and the ability to assess their effectiveness at scale.
• We require a strong offensive security skillset, including manual web and API testing, authentication and authorisation bypass, session management, business-logic abuse, and data-protection testing.
• We require advanced knowledge of threat remediation techniques specific to the programming languages we use.
• We require strong awareness of advanced persistent threats, threat actor tactics such as MITRE ATT&CK, and emerging vulnerability classes, with the ability to apply this to test strategy design.
• We require the ability to build and own automation, including scripting test cases in Python and Bash, integrating with TestRail and Jira, building automated Burp Suite Pro scanning workflows in CI/CD, and working knowledge of tools such as Postman and SonarQube.
• We require excellent communication skills and the ability to influence technical and non-technical stakeholders.
• We prefer recognised advanced certifications such as OSCP or OSWE.
• You must have the right to work in the UK at the time of application, as we are unable to offer visa sponsorship for this position.

Responsibilities:

• We lead advanced security testing of critical applications and services, including deep-dive manual testing and targeted penetration tests across web, mobile, and API surfaces.
• We own threat modelling using structured frameworks such as STRIDE and PASTA, producing threat models for new features and architecture changes.
• We support and engage in the penetration testing programme.
• We design security test strategies for new products and major changes.
• We act as a subject-matter expert and primary point of contact between engineering and the Application Security team.
• We provide oversight of scanning-tool usage and KPIs in the CI/CD pipeline.
• We own the overarching triage, escalation, and evidence-quality framework across all scanning tools and testing streams, resolving the most complex or contested findings and setting the standard for L1/L2 analysts and specialists.
• We track and report key security testing metrics such as time-to-remediate and recurring defect patterns to senior stakeholders.
• We build and maintain advanced test cases, automation frameworks, and custom tooling to improve coverage and efficiency.
• We own the security release process, including remediation verification and closure standards.
• We mentor and coach analysts and specialists, provide training material and playbooks, and quality review finding reports.
• We act as an escalation point for L1/L2 security analysts.
• We provide expert-level root-cause analysis and remediation guidance for the most complex or systemic security defects and set remediation standards for developers and L1/L2 analysts.
• We develop and maintain process documentation and testing standards.

Technologies:

• AI
• API
• Android
• Bash
• CI/CD
• Cloud
• Support
• JIRA
• Kubernetes
• LLM
• Mobile
• Network
• OWASP
• Postman
• Python
• RBAC
• Security
• Web
• iOS

More:

We are Global Relay, a career-building company with more than 25 years of experience setting the standard in enterprise information archiving. We provide industry-leading cloud archiving, surveillance, eDiscovery, and analytics solutions that securely capture and preserve communications data for highly regulated firms, helping them maintain visibility, control, and compliance. We offer competitive compensation, benefits, mentoring, coaching, and support, and we foster a collaborative, inclusive environment where diverse teams can learn from one another and make a real impact. We are committed to diversity, equity, and inclusion, and we tailor reasonable adjustments and accommodations to individual needs.

last updated 34 week of 2026