Application Security Engineer

Application Security Engineer Overview

As the first engineering hire in Rightmove’s expanding Application Security function, you will report to the Lead Application Security Engineer. Your role will involve collaborating closely with engineering teams to implement daily application security capabilities, including security tooling, vulnerability management, secure design, and threat modeling, while also contributing to the evolution of the Application Security function.

Key Responsibilities

• Support the implementation and management of application security tools across engineering repositories, including SAST, SCA, and secrets detection.
• Triage and categorize security findings across repositories, ensuring the remediation of identified vulnerabilities.
• Oversee the daily operations of vulnerability management, including monitoring findings and engaging with engineering teams.
• Provide guidance for engineers on how to resolve vulnerabilities and request exceptions.
• Assist in managing cloud security posture through Prisma Cloud, including monitoring and engaging with relevant engineering and platform teams.
• Establish a risk-based engagement schedule with engineering teams based on service level agreement (SLA) compliance.
• Triage incoming security requests according to the AppSec triage SLA.
• Conduct security reviews for new services, integrations, and requests for comments (RFCs), including API security assessments.
• Review and respond to requests for penetration testing and third-party integration assessments.
• Facilitate threat modeling sessions using established guidelines and improve threat modeling practices across teams.
• Maintain documentation and runbooks as the Application Security function evolves.
• Support regular review processes such as access reviews and vulnerability audits.

Requirements

• Demonstrated experience in application security, security engineering, or a similar hands-on security role.
• Ability to evaluate security findings in context, differentiate significant risks from false positives, and provide practical recommendations to engineering teams.
• Proficiency in Python, capable of reading, modifying, and writing scripts for internal tools.
• Experience with application security tools such as DAST, SAST, SCA, and secrets scanning tools like Aikido, Snyk, Semgrep, or Checkmarx.
• Familiarity with Prisma Cloud or similar cloud-native security platforms.
• Comfortable with reading code and understanding CI/CD pipelines, such as GitLab CI.
• Experience in conducting or contributing to threat modeling exercises.
• Ability to manage recurring stakeholder meetings with engineering teams.
• Strong written communication skills and the ability to independently prioritize and triage a high volume of requests.

Benefits

• Cash plan for dental, optical, and physiotherapy treatments.
• Private medical insurance, pension plan, and life insurance.
• Employee assistance program.
• 27 days of annual leave plus two paid volunteering days each year, with options for holiday buy schemes.
• Contributory stakeholder pension.
• Life assurance at four times the basic salary for designated beneficiaries.
• Competitive salary package.
• Paid leave for maternity, paternity, adoption, and fertility.
• Travel loans, bike-to-work scheme, and rental deposit loans.
• Charitable contributions through payroll giving and donation matching.
• Access to discounts on travel, electronics, fashion, gym memberships, cinema tickets, and more.

This position operates on a hybrid working model, requiring a minimum of two days per week in the office.

Degree Requirement: Not Specified

Visa Sponsorship May be