What you'll be doing

Define and own the product security roadmap, aligning with business goals and influencing engineering leadership to embed security.
Establish and manage the application security vulnerability process, including triage, prioritisation, remediation tracking, and reporting key metrics.
Conduct threat modelling for web, mobile, and API services, identifying risks and implementing countermeasures.
Assess application and API security via code reviews, SAST/DAST testing, and manage third-party penetration tests.
Enhance security of iOS and Android apps and their APIs, focusing on authentication, authorisation, secure data storage, and protection against abuse.
Implement, maintain, and automate security tools supporting development and operations, including vulnerability scanning and posture management.
Provide training and mentoring to build secure coding and deployment knowledge, and help develop a security champions programme.
Ensure alignment with security frameworks and standards such as OWASP, NIST, ISO 27001, GDPR, and PCI DSS, supporting compliance and audit efforts.

Requirements

Significant experience identifying, assessing, and mitigating security risks across application design, code, and deployed products.
Proven ability to shape and deliver a product or application security roadmap, influencing engineering leaders and using metrics to demonstrate risk reduction.
Experience securing mobile applications and APIs, including knowledge of authentication and authorisation protocols like OAuth 2.0 and OpenID Connect.
Hands-on experience with security testing tools such as SAST, DAST, vulnerability scanning, and mobile/API security testing tools.
Practical expertise in threat modelling, security reviews, and managing third-party penetration tests collaboratively with engineering teams.
Strong knowledge of secure coding practices and embedding security in software development workflows, including automation in CI/CD pipelines.
Familiarity with industry standards and frameworks including OWASP (with Mobile Application Security Verification Standard and API Security Top 10), PCI DSS, ISO 27001, and GDPR.

Experience setting up or growing a security champions programme.
Experience running risk assessments or working knowledge of regulatory compliance standards.

Private healthcare and dental insurance.
Generous work from abroad policy (28 days).
2-for-1 share purchase plans.
Electric Vehicle (EV) Scheme to reduce carbon emissions.
Extra festive time off and excellent family-friendly benefits.
Clear career paths, transparent pay bands, personal learning budgets, and regular learning days.
Hybrid working model requiring minimum 60% office presence over 12 weeks.