Application Security Recruitment

Application security is the discipline of embedding security into the software development lifecycle — from threat modelling and secure code review through to vulnerability management and DevSecOps toolchain integration. We recruit AppSec engineers and architects who speak the language of both security and development.

The market

AppSec sits at the intersection of software development and security — a combination that's hard to find because the two disciplines develop along different career paths. The most effective AppSec professionals have written code professionally and then built security depth on top, or come from a security background with genuine software engineering experience. This double-depth profile is consistently among the hardest to source in the market.

Roles we recruit

• AppSec Engineer
• Application Security Architect
• DevSecOps Engineer
• Secure Code Reviewer
• DevSecOps Lead
• Product Security Engineer
• Security Champion Programme Lead
• API Security Specialist

Experience and skills

The best AppSec candidates have a software engineering background and have developed security depth, often through penetration testing exposure, SAST/DAST tooling, or specific application security training. Those who have designed and built developer security education programmes or run security champion schemes are particularly valuable to mature AppSec functions.

• SAST / DAST / SCA Tooling (Checkmarx, Veracode, Snyk)
• OWASP Top 10 & ASVS
• Threat Modelling (STRIDE, PASTA)
• CI/CD Pipeline Security Integration
• API Security Testing
• Secure Code Review
• Scripting / Development Background (Python, Java, JS)
• CSSLP or equivalent