Application Security Engineer

📋 Job Overview

At OakNorth, we're on a mission to empower ambitious businesses and the communities they serve. Since 2015, we've lent over $21 billion across the UK and US, helped create more than 58,000 new homes and 36,000 new jobs, and supported hundreds of thousands of personal savers — all while driving economic growth in the markets we serve.

🏢 About OakNorth

The Application Security Engineer is a hands-on, full-stack security role focused on fixing the hardest application and AI security problems — particularly those that cross team boundaries or involve architecture, authentication, and authorisation that automation cannot yet safely resolve. You'll take remediation load away from engineering teams so they can stay focused on delivery, working closely with the teams that detect, prioritise, and track vulnerabilities. You'll also contribute to the development of OakNorth's internal coding agent platforms, so security fixes can scale safely.

🎯 The Role

The Application Security Engineer is a hands-on, full-stack security role focused on fixing the hardest application and AI security problems — particularly those that cross team boundaries or involve architecture, authentication, and authorisation that automation cannot yet safely resolve. You'll take remediation load away from engineering teams so they can stay focused on delivery, working closely with the teams that detect, prioritise, and track vulnerabilities. You'll also contribute to the development of OakNorth's internal coding agent platforms, so security fixes can scale safely.

✅ Key Responsibilities

• Fix complex application security vulnerabilities directly, including architectural weaknesses and issues in legacy technology that automated remediation cannot yet handle safely.
• Lead remediation of problems that cross team and system boundaries, coordinating changes across multiple owners and services and seeing them through to resolution.
• Resolve authentication and authorisation weaknesses, including identity, access control, session and token handling, service-to-service trust and permission models.
• Act as a dedicated delivery vehicle for security remediation, reducing the fix burden on engineering teams so they can focus on product delivery.
• Interpret the output of security tooling (e.g., SAST, DAST, SCA, secrets, container and IaC scanning), validate findings, identify root causes and implement the right fix rather than only triaging.
• Secure agentic and AI-enabled systems, assessing and mitigating risks such as those in the OWASP Top 10 for Agentic Applications, including prompt injection, excessive agent permissions, tool misuse, insecure agent-to-agent communication and unsafe handling of agent outputs.
• Contribute to the development of our internal coding agent platforms, including remediation agents, by supplying specialist fixes, remediation patterns, evaluation cases and feedback on where agents succeed or fail.
• Define and build guardrails for agent-generated and human-written changes (e.g., least-privilege agent access, human approval points, secure defaults, shared libraries, pipeline checks and policy-as-code) so that changes are safe and vulnerabilities do not recur.
• Build and secure GitHub workflows and release pipelines, including GitHub Actions hardening, secrets and token handling, branch protection, dependency and supply chain controls, and security gates in CI/CD.
• Plan and deliver higher-risk changes safely, including testing, peer review, rollout and rollback approaches, in partnership with the teams that own the systems.
• Work with the teams that detect, prioritise and track vulnerabilities to take prioritised findings through to remediation, and identify recurring fix types that can be automated safely.
• Document remediation approaches, share knowledge and coach engineers on secure design, secure coding and the safe use of AI coding agents.
• Report on remediation progress, including backlog reduction, SLA performance and risk reduction, and provide evidence to support audit and regulatory requirements.

📌 Required Qualifications

• Full stack engineering experience across front end, back end and APIs, with proficiency in one or more languages (e.g., Java, Python, C#, JavaScript/TypeScript) and the ability to work in unfamiliar and legacy codebases.
• Strong hands-on experience with GitHub (pull requests, code review, branch protection, code scanning) and GitHub Actions, including building and securing release pipelines.
• Working knowledge of cloud platforms, containers and infrastructure as code.
• Ability to review code, find vulnerabilities and implement practical, correct fixes.
• Strong application security knowledge, including the OWASP Top 10 and common vulnerability classes such as injection, broken access control, insecure deserialization and cryptographic weaknesses.
• Deep understanding of authentication and authorisation, including OAuth 2.0, OIDC, SAML, JWT and session handling, RBAC/ABAC models and service-to-service identity.
• Hands-on experience interpreting application security tooling output (SAST, DAST, SCA, secrets, container and IaC scanning), distinguishing true and false positives and finding root cause.
• Understanding of CI/CD and software supply chain security, including GitHub Actions risks such as untrusted input, over-privileged tokens and third-party action pinning.
• Day-to-day experience using coding agents such as Claude to write, review and fix code, with sound judgement on where they are reliable and where they are not.
• Knowledge of and informed opinions on the OWASP Top 10 for Agentic Applications and related AI security risks, including prompt injection, tool and permission abuse, data leakage and agent identity.
• Ability to design guardrails, permission boundaries and evaluation approaches for AI agents and agent-generated changes.
• Ability to turn manual fixes into repeatable patterns and test cases that agent platforms can use.
• Experience fixing architectural and design-level security issues, and making safe changes in systems with limited tests, documentation or clear ownership.
• Ability to plan and deliver changes that span multiple teams and services, managing dependencies and risk.
• Sound judgement on testing, rollout and rollback for higher-risk changes.
• Ability to work as a trusted partner to engineering teams, building strong relationships and collaborating effectively to solve complex problems.

⭐ Desirable Experience

• Experience with financial services or fintech security practices.
• Knowledge of regulatory compliance requirements (e.g., PCI DSS, GDPR, SOX).
• Experience with security automation and tooling development.
• Background in threat modeling and secure design principles.

🎁 Benefits

Competitive salary and benefits package.

🛂 Visa & Eligibility

Eligibility to work in India required.