Application Security Manager

About the role

A large, diverse organisation is building its application security function from scratch and is recruiting an Application Security Manager. Reporting to the Head of Security Engineering & Platforms as second-in-command, you will own the application security advisory capability, focusing on architecture and how applications are designed, built and secured. The security function backs in-house capability over off-the-shelf fixes, and the role suits someone who wants to build rather than inherit.

Key responsibilities

• Build the AppSec function from the ground up, including standards, patterns, control requirements and assurance processes
• Own security architecture input and secure-by-design practices across application delivery
• Embed DevSecOps practices into delivery pipelines where they make sense
• Lead application risk assessments, design reviews and threat modelling, and oversee security testing and remediation
• Work with delivery teams, architects, risk, technology and strategic partners to improve application security
• Report on application risk, control gaps, remediation progress and capability maturity

Required profile

• Solid application security background, with hands-on experience in secure design reviews, threat modelling, security testing and vulnerability remediation
• Built's mindset: comfortable with ambiguity and eager to create something new
• Curious, willing to learn, with attitude and capability valued more than a perfect checklist
• Strong communication skills and the ability to influence technical and business stakeholders

What we offer

• Genuine greenfield work with your fingerprints on the function from day one
• A step into leadership with the scope and backing to shape a capability
• Varied, meaningful environment across critical infrastructure and essential services
• Flexible working: 2-3 days in the office, with Tuesday as the team anchor day

The team is tool-agnostic, so candidates with no specific tooling history are welcome. Applications are made through the recruiter, who offers confidential conversations.