Senior Application Security Engineer

About the role

Capital.com’s Product Security team is looking for a Senior Application Security Engineer to raise the bar for application security across the organisation. You will design, automate, and scale security processes so engineering teams can build securely by default.

Key responsibilities

• Lead security architecture reviews and threat modelling for new and existing systems, leveraging AI tools for speed and consistency.
• Design, build, and automate scalable security processes and self‑service tooling covering secure design review, testing, and remediation workflows.
• Integrate security checks (SAST, DAST, SCA, secrets, IaC scanning) into CI/CD pipelines and own platforms such as DefectDojo.
• Conduct security assessments of web, mobile, API, and cloud assets, run vulnerability scans, and manage remediation to closure.
• Support and triage the Bug Bounty program, automate triage where possible, and participate in red‑team exercises.

Required profile

• 5+ years of experience in application or product security with senior‑level impact.
• Proven track record leading security architecture reviews and threat modelling across multiple teams.
• Strong communication and influencing skills, able to drive security standards without direct authority.
• Self‑starter who enjoys solving complex problems, building automation, and mentoring others.

Required skills

• Hands‑on security testing: code review, web, mobile, API assessments, bug bounty triage.
• Software engineering in Python, Go or JavaScript for automation.
• Deep knowledge of OWASP Top Ten, secure design, and secure coding practices.
• Experience with SAST, DAST, SCA tools and CI/CD integration.
• Understanding of modern architectures: REST APIs, microservices, cloud, containers.
• Practical use of AI/LLM tooling for security work.

What we offer

• Work‑life balance with hybrid working (3 days office, 2 days remote).
• Annual bonus based on performance.
• Generous annual leave, medical insurance, pension and additional location‑based benefits.
• Workation policy with 30 extra remote days and paid volunteering leave.