Basic qualifications

5+ years of experience in application security, security engineering, or a closely related role.
Experience performing threat modelling and architecture security reviews on complex, multi-component platforms.
Strong knowledge of authentication and authorization patterns — OAuth, OIDC, RBAC, privileged access management.
Hands-on experience validating API security and reviewing integration patterns across third-party services.
Solid understanding of secrets management, credential handling, and token lifecycle best practices.
Experience supporting or coordinating vulnerability scanning and penetration testing programmes.
Knowledge of encryption standards and secure data handling practices across storage and transit.
Familiarity with GDPR and privacy-by-design engineering requirements.
Ability to produce clear remediation guidance and security acceptance documentation for engineering and delivery teams.

Preferred qualifications

Experience securing composable CMS or media platform architectures — AEM, Amplience, or similar.
Background working on high-traffic, public-facing platforms where availability and security intersect.
Experience with security logging and monitoring tooling — SIEM, alerting, incident response playbooks.
Familiarity with third-party vendor security assessment processes.
Relevant certification — CISSP, OSCP, CEH, or equivalent.
Experience working within a phased, full-lifecycle delivery programme alongside engineering and architecture teams.

We are looking for an Application Security Engineer to join a greenfield digital news platform build for a major international news brand. Security is not a pre-launch checklist here — it is an engineering requirement embedded across every phase of delivery, from architecture through launch and into multi-year support.

You'll be the security authority on a full-lifecycle engagement, validating controls across a composable CMS, video pipeline, advertising integrations, personalisation services, and public-facing APIs — on a platform designed to sustain extreme traffic during breaking-news events.

,[Define and validate application and platform security controls across all delivery phases. , Perform architecture and threat-model reviews at design stage and as the platform evolves. , Review authentication, authorization, and privileged-access controls across CMS, APIs, and integrated services. , Validate API and integration security across a composable, multi-vendor platform architecture. , Review secrets, credentials, and token-management practices across the full stack. , Support vulnerability scanning and penetration-testing activities — coordinating findings and remediation. , Validate encryption and secure data handling across storage, transit, and third-party integrations. , Review security logging, monitoring, and incident-response requirements. , Support GDPR and privacy engineering requirements throughout delivery. , Conduct third-party security assessments for integrated services and vendors. , Provide remediation guidance and produce security acceptance evidence ahead of launch.] Requirements: Security, API, Storage, GDPR, OAuth, RBAC, CMS, Testing, CISSP, OSCP Tools: Agile, Scrum. Additionally: Private healthcare, Sport subscription, International projects, Free coffee, Playroom, Shower, Free snacks, Free beverages, No dress code.

Application Security Engineer

Zacznij od adresu e-mail