Senior Application Security Engineer

Salary: £72,000 - 97,000 per year

Requirements:

• 5+ years in application security or a security engineering role with a strong AppSec component
• Practical experience embedding security in the SDLC, including threat modelling frameworks such as STRIDE, secure design review, and direct work with engineering teams
• Hands-on experience with SAST, DAST, and SCA tooling and CI/CD pipeline integration
• Strong grasp of OWASP Top 10 and secure coding practices across at least one major language or framework used in production
• Experience coordinating and running penetration testing programmes, including remediation tracking
• Comfortable communicating security risk clearly to engineering and product audiences and influencing senior leadership
• Demonstrable experience with adversarial security testing
• Demonstrated experience in reviewing, threat modelling, and securing agentic and AI systems
• Great communication skills and stakeholder management, including influencing stakeholders and building relationships
• Strong critical thinking skills and a curiosity for learning new technologies and frameworks
• Strong troubleshooting skills and the ability to think outside the box
• Nice to have: strong links to the AppSec community and industry, including conferences, OWASP, open-source contributions, public speaking, or thought leadership
• Nice to have: OSCP, CSSLP, or equivalent hands-on offensive/AppSec certification
• Nice to have: experience in a regulated financial services environment
• Nice to have: prior experience running or scaling a security champions programme
• Nice to have: exposure to cloud-native application security, including containers, serverless, and API security

Responsibilities:

• Own the AppSec programme for Flagstone and report on its success to relevant stakeholders, including leadership
• Formalise a secure development lifecycle, including threat modelling and secure design review for new features and systems, working directly with engineering teams during design rather than after the fact
• Introduce security gates and guardrails and help ensure applications remain secure post-deployment
• Run and continuously improve secure code review practices, including SAST, DAST, and SCA tooling integrated into CI/CD pipelines and code review, manually and/or with AI assistance
• Coordinate external and execute internal penetration test engagements, including scope, logistics, findings triage, and remediation to closure with engineering teams
• Maintain and evolve secure coding standards
• Run a security champions programme to scale AppSec practice across engineering
• Track and report on vulnerability management across the application estate, prioritising by exploitability and business impact
• Contribute AppSec expertise to incident response where application-layer issues are involved
• Manage application cyber risk according to the internal Flagstone Risk Framework

Technologies:

• AI
• API
• CI/CD
• Cloud
• Support
• OWASP
• Security
• Serverless

More:

We are Flagstone, an online savings platform reinventing how individuals, businesses, and charities manage, protect, and grow their cash. We are a diverse, collaborative, and profitable business with a culture built on kindness, respect, and growth. This is a new AppSec-focused role within Security Engineering, working closely with product engineering teams across the SDLC and alongside GRC/Compliance rather than inside it. We offer a competitive bonus scheme, a flexible benefits budget, salary sacrifice options, a 3-month work-from-anywhere scheme, mental wellbeing support, a £1,000 personal development budget, private healthcare, a medical cash plan, life insurance and income protection, matched pension contributions up to 5%, 25 days holiday plus bank holidays, wellbeing and volunteering days, and enhanced parental leave. The role is based in our London office on a full-time hybrid basis, and we welcome applicants from all backgrounds.

last updated 36 week of 2026