Senior Information Security Engineer

• Own the end-to-end vulnerability management lifecycle across products and supporting technology
• Identify, validate, prioritise, track remediation, manage risk acceptance and report vulnerabilities
• Triage and validate findings from SAST, DAST, SCA, secrets scanning, penetration testing and web application scanning
• Work with Engineering and Product teams to drive vulnerability remediation and meet remediation timelines
• Partner with teams integrating security tooling into CI/CD pipelines
• Improve the quality, coverage and effectiveness of security tooling
• Develop and improve risk-based vulnerability prioritisation using exploitability, asset exposure, business criticality, threat intelligence and compensating controls
• Identify recurring vulnerability patterns and root causes to reduce systemic weaknesses
• Improve vulnerability management processes, dashboards and workflows
• Support security reviews of software supply chain risks, dependency management, build pipeline security and secure software development practices
• Review and validate cloud security and CSPM findings
• Help Infrastructure and Engineering teams prioritise and remediate cloud vulnerabilities and configuration weaknesses
• Research emerging cloud threats, vulnerabilities and misconfiguration patterns
• Recommend mitigations and support implementation of cloud security controls and security baselines

• Strong technical background in application security, vulnerability management or software engineering
• Clear understanding of how vulnerabilities arise and how they should be remediated
• Practical experience with SAST, DAST, SCA and secrets scanning
• Experience integrating security tooling into modern CI/CD environments
• Ability to assess vulnerabilities based on exploitability, internet exposure, asset criticality, available exploits and compensating controls
• Experience with software supply chain security, including SLSA, dependency security and secure build pipelines
• Solid grounding in public cloud security, particularly AWS and/or Azure
• Understanding of cloud vulnerabilities including overly permissive identities, exposed services, insecure storage, vulnerable workloads and configuration drift
• Experience in vulnerability management is requested on the application form

• One way (Drop) Transport will be provided for the women colleagues
• Continuous learning and career development opportunities
• Culture that celebrates diversity and empowers every individual
• Workplace accommodations and adjustments during the hiring process
• Full-time permanent employment