Senior Application Security Engineer

About the role

You will protect CMC's customer‑facing trading platforms, working across the software delivery lifecycle to embed security, review designs and implement controls. The role is hands‑on, focusing on platform security for stockbroking and CFD trading services.

Key responsibilities

• Design, implement and continuously improve security controls for trading platforms and APIs.
• Partner with engineering, development and DevOps teams to embed security throughout design, development and operation.
• Provide security guidance for new platform capabilities and technology initiatives.
• Review vulnerability assessments and penetration‑testing reports, prioritising and driving remediation.
• Lead or support investigation and response to security incidents affecting platforms and customer accounts.
• Drive continuous improvement of security tooling, automation, monitoring and detection.

Required profile

• 5+ years experience in application, platform or security engineering, preferably in financial services or other highly regulated environments.
• Proven experience securing customer‑facing platforms, applications and APIs.
• Strong hands‑on experience with Web Application Firewalls and other application‑layer controls.
• Excellent communication and stakeholder‑engagement skills across technical and non‑technical teams.

Required skills

• Web Application Firewall (WAF) implementation and management.
• Authentication, authorisation and identity‑provider concepts.
• Cloud security controls and architecture.
• Vulnerability assessment and penetration‑testing review.
• Security incident investigation and response.

What we offer

• Birthday leave and an annual charity day.
• Zero‑commission trades for staff and family accounts.
• Continuous learning through technical and performance training.
• Access to a benefits & wellbeing hub with discounts and resources.
• Office‑based collaboration with free breakfast cereals, condiments and coffee.