Senior Application Security Engineer

📋 Job Overview

Capital.com's Product Security team protects our web and mobile applications, infrastructure, and external perimeter in a highly regulated environment. As Senior/Staff Application Security Engineer, you will raise the bar for application security across the organisation. This role is measured by leverage: how well you design, automate, and scale security processes so that many engineering teams can build securely by default.

🏢 About Capital.com

Capital.com is a financial services company that provides trading and investment services to clients worldwide. The company operates in a highly regulated environment and is committed to maintaining the highest standards of security and compliance.

🎯 The Role

You will lead security architecture reviews and threat modelling, increasingly with the help of AI tooling, and turn one-off security work into repeatable, self-service capabilities. The role combines deep hands-on offensive and defensive security expertise with the engineering mindset needed to automate at scale. You will work closely with development, QA, DevOps, and platform teams.

✅ Key Responsibilities

• Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams
• Act as a security force multiplier by influencing the standards, patterns, and guardrails that let teams move fast and stay secure
• Design, build, and automate scalable security processes that engineering teams can self-serve, covering secure design review, threat modelling, testing, and remediation workflows
• Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning), tuned for strong signal and low friction
• Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms, maximising automation, coverage, and integration
• Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define how the team adopts these tools safely
• Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development
• Run vulnerability scans across internal infrastructure and the external perimeter, then analyse findings, define remediation, and track issues to closure
• Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible
• Participate in and help lead red teaming and offensive security exercises
• Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams

📌 Required Qualifications

• 5+ years in application or product security, or equivalent depth, with a track record of senior or staff-level impact
• Demonstrable experience leading security architecture reviews and threat modelling (e.g. STRIDE, attack trees, data-flow analysis) across multiple teams or products
• Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort
• Strong hands-on security testing skills, including code review and web, mobile, and API application security assessments, as well as the ability to triage and validate external vulnerability reports and bug bounty submissions
• Strong software engineering ability in at least one language (e.g. Python, Go, JavaScript), with the ability to build automation, not just scripts
• Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices
• Experience with SAST, DAST, SCA, and vulnerability management platforms, and integrating them into CI/CD
• Strong understanding of modern application architectures: REST APIs, microservices, cloud-based systems, and containers
• Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so
• Excellent communication and influencing skills: you can explain security concepts to technical and non-technical stakeholders and drive change without direct authority
• A self-starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture

⭐ Desirable Experience

• Experience securing the AI harness: hardening LLM and agent pipelines, prompts, tool and MCP integrations, and model endpoints against prompt injection, data leakage, and insecure agent actions
• Experience securing Kubernetes, including cluster hardening, RBAC, network policies, admission control, workload isolation, and image and supply-chain security
• Experience securing AWS infrastructure, including IAM, network and account architecture, key and secret management, and CSPM
• Experience building AI-assisted security tooling or internal self-service security platforms
• Experience mentoring or technically leading a security team
• Offensive or advanced security certifications such as OSAI, OSEP, OSCP, or OSWE

🎁 Benefits

• You will join the company, that cares about work and life balance
• Annual Bonus based on the performance review cycle
• Generous Annual Leave Policy
• Medical Insurance and Pension fund, with additional benefit package

🛂 Visa & Eligibility

No visa or eligibility information provided.