Application Security & DevSecOps Specialist

In this hands-on role, you strengthen application security across the software lifecycle, embedding automated testing into development pipelines and managing external attack surface risks. You will collaborate with engineering, DevOps, and security teams to identify and remediate vulnerabilities while supporting secure AI technologies and security practices. The role offers exposure to shift-left security, vulnerability management, and AI security controls at scale. You will help drive the organisation’s security posture and governance through measurable metrics.

• Implement and manage application security testing across the software development lifecycle (SAST, DAST, SCA)
• Integrate automated security scanning and vulnerability controls into CI/CD pipelines (shift-left)
• Manage and validate vulnerabilities through manual testing, risk assessment, and remediation tracking
• Oversee external attack surface management, identifying exposed assets, domains, misconfigurations and security risks
• Configure and maintain application security and vulnerability scanning tools with coverage and reporting
• Collaborate with development/engineering teams to address security vulnerabilities and improve secure coding practices
• Assess security risks for AI applications, LLMs, and ML technologies
• Support AI security controls and explore automation to enhance cyber defence
• Produce security metrics and reports on vulnerabilities, remediation progress, and overall posture

• Proven experience in Application Security, DevSecOps, or similar hands-on cyber security role
• Strong experience with SAST, DAST, and SCA tools (Checkmarx, Snyk, Semgrep, Burp Suite, OWASP ZAP)
• Experience integrating automated security testing and controls into CI/CD pipelines
• Ability to investigate, validate, and remediate application security vulnerabilities
• Experience with attack surface management, asset discovery, domain security, and external exposure monitoring
• Knowledge of vulnerability assessment tools (e.g., Shodan) and risk prioritisation (CVSS)
• Understanding of secure software development, API security, and common vulnerabilities
• Awareness of AI security risks (prompt injection, data poisoning, LLM vulnerabilities)
• Familiarity with security frameworks (OWASP Top 10, MITRE ATLAS) is advantageous
• Excellent communication and stakeholder management skills

• communication
• stakeholder management
• collaboration
• SAST
• DAST
• SCA