Application Security Engineer

Help teams build secure ordering and partner-management workflows without making everyday development unnecessarily difficult.

The job

You will work alongside engineers to identify realistic threats, improve default protections and verify fixes. The most valuable work may be a clear authorisation rule, a safer integration pattern or a repeatable way to test restaurant separation. You will combine technical investigation with practical communication, helping colleagues understand both the risk and the best way to address it. Security testing in this role is limited to authorised systems and agreed scopes.

What you would be doing

• Threat-model customer, merchant and administrative workflows with the teams that own them.
• Review authentication, session handling, authorisation and tenant isolation.
• Perform scoped application testing and help engineers reproduce and fix findings.
• Improve dependency, secret and code-scanning workflows with actionable feedback.
• Create secure implementation patterns for integrations, uploads and sensitive data access.
• Support security incident investigation and document proportionate follow-up actions.
• Track remediation and explain risk in terms of customer and operational impact.

What we are looking for

• Experience securing modern web applications and APIs.
• Strong understanding of common application vulnerabilities and access-control failures.
• Ability to read application code and work with engineers on practical remediation.
• Experience producing clear, reproducible security findings within an authorised scope.
• Sound judgement when prioritising risk and handling sensitive information.

Useful, but not essential

• Experience with TypeScript, Next.js or PostgreSQL.
• Familiarity with multi-tenant SaaS or commerce platforms.
• Experience with security automation and developer education.

Tools you might use

• Application security testing tools
• TypeScript
• SQL
• Dependency scanning
• Threat modelling
• CI pipelines

Your first 90 days

• Days 1–30Map critical trust boundaries and agree an authorised review scope with engineering.
• Days 31–60Complete a focused review and help teams resolve the highest-priority actionable findings.
• Days 61–90Introduce a repeatable check or secure pattern that reduces the likelihood of the same issue recurring.

The practical bits

• 2 days per week in the London office and 3 days working remotely within the UK.
• 37.5 hours per week, Monday–Friday. Core collaboration hours are agreed with the team.
• Occasional planned team or customer visits; approved expenses are reimbursed.

What we offer

• 30 days of annual leave plus public holidays
• A company pension contribution
• A £1,000 annual learning budget for courses, conferences or professional development
• A company laptop and role-appropriate equipment; engineering roles include a development setup
• Flexible start and finish times, agreed with your team around customer and collaboration needs
• Wellbeing support and regular development conversations with your manager
• Reimbursement of approved business travel and customer-visit expenses