What you'll be doing

Own the application security program end to end: threat modelling, secure design reviews, code review, and vulnerability management.
Build security into the SDLC with SAST, DAST, dependency/SCA, and secrets scanning integrated into CI/CD without slowing teams down.
Partner with engineering on authentication, authorization, multi-tenancy isolation, and data protection across APIs and SDKs.
Lead penetration testing, bug bounty triage, and incident response for application-layer issues.
Support customer security reviews and compliance (SOC 2, HIPAA, GDPR) with practical technical controls.
Mentor engineers and raise the security bar across the organisation.

Requirements

7+ years in software or security engineering, with significant hands-on application security experience.
Strong coding ability in Python and/or TypeScript and the credibility to review and fix code.
Deep knowledge of web and API security (OWASP Top 10, OAuth/OIDC, authorization models, SSRF, injection, deserialization).
Experience securing cloud-native SaaS platforms (GCP or AWS, Kubernetes, containers).
Track record of building security tooling and processes in a fast-moving product company.
Clear communicator able to influence engineering teams and engage with enterprise customers.

Experience with ML/AI systems security, including data pipelines, model supply chain, and LLM-specific risks such as prompt injection.
Background in regulated industries such as healthcare.
Previous experience as an early or first dedicated security hire.

Competitive salary and meaningful equity in a high-growth startup.
Strong in-person culture with most of the team working from the London office 4+ days/week.
25 days annual leave plus UK public holidays.
Annual learning and development budget.
Travel opportunities for customer visits, events, and conferences across the UK and Europe.
Daily company lunches.
Monthly socials and bi-annual team offsites.