Application Security Design Engineer
Posted 3 days ago by ST Global Tech LLC
Negotiable
Inside
Undetermined
Leeds, England, United Kingdom
Summary: The Application Security Design Engineer role in Leeds, UK, focuses on embedding security by design across the change portfolio of a major bank. The position requires applying Agile methodologies, conducting threat modeling, and designing secure solutions while ensuring compliance with security standards. The role is integral to enhancing the security posture of the organization, impacting over 30 million customers. Candidates should possess a dynamic approach to problem-solving in a fast-paced environment, with a strong foundation in cyber security principles and practices.
Key Responsibilities:
- Applying Agile methodologies to support engineers and deliver on multiple challenging product initiatives simultaneously, driving engineering excellence.
- Threat model by deconstructing technical solutions, identifying threats and vulnerabilities and assessing risks.
- Use experience to analyse the risks and benefits of design options to support making safe architectural decisions.
- Design secure solutions documenting the key security controls and adhering to security standards.
- Define security testing requirements and assess findings.
- Effectively communicate technical concepts to both technical and nontechnical audiences, providing security direction, governance, assurance and guidance.
Key Skills:
- Dynamic solution-oriented individual bringing energy to a rapidly evolving environment with an ability to work well under pressure.
- Broad knowledge of modern Enterprise technologies including Cloud and AI.
- Exposure to contemporary architectures eg. RESTful APIs and containerised microservices.
- Up-to date on emerging threats and experienced with threat modelling frameworks eg. STRIDE / MITRE ATT&CK.
- Significant knowledge of cyber security domains and how they apply to Enterprise business environments eg. endpoint, network, cryptography and IAM.
- Aware of industry related security standards such as ISO 27000 series, PCI DSS, COBIT, NIST, OWASP.
- Certifications in security management eg. CISSP / CISM / CCSP or equivalent.
- Certifications in technical security domains eg. CEH / OSCP or equivalent.
- Experience of Public and or Private cloud environments.
- Experience in DevSecOps Tooling/processes (K8, Harness, Terraform, GitHub, SAST/DAST, SDLC).
Salary (Rate): 350 GBP/Day
City: Leeds
Country: United Kingdom
Working Arrangements: undetermined
IR35 Status: inside IR35
Seniority Level: undetermined
Industry: IT
Application Security Design Engineer
Location: Leeds, UK
6 Months+
Rate: 350 GBP/Day
Inside IR35
We are actively welcoming enthusiastic Cyber Security Professionals from all industries and backgrounds to join our expanding team as we embark on an exciting journey where you will have the opportunity to ensure security by design is embedded across our change portfolio. Cyber Security sits at the heart of our business providing the Group with a secure operating environment, safe from malicious attacks. It is a dynamic and constantly evolving world where your experience and efforts can deliver tangible results to the safety of a huge company and over 30m customers. We’re on the mission to build the bank of the future, and we need your help to do it!
What you'll do:
- Applying Agile methodologies to support engineers and deliver on multiple challenging product initiatives simultaneously, driving engineering excellence.
- Threat model by deconstructing technical solutions, identifying threats and vulnerabilities and assessing risks.
- Use experience to analyse the risks and benefits of design options to support making safe architectural decisions.
- Design secure solutions documenting the key security controls and adhering to security standards.
- Define security testing requirements and assess findings.
- Effectively communicate technical concepts to both technical and nontechnical audiences, providing security direction, governance, assurance and guidance.
What we're looking for:
- Dynamic solution-oriented individual bringing energy to a rapidly evolving environment with an ability to work well under pressure.
- Broad knowledge of modern Enterprise technologies including Cloud and AI
- Exposure to contemporary architectures eg. RESTful APIs and containerised microservices.
- Up-to date on emerging threats and experienced with threat modelling frameworks eg. STRIDE / MITRE ATT&CK.
- Significant knowledge of cyber security domains and how they apply to Enterprise business environments eg. endpoint, network, cryptography and IAM.
The nice to haves:
- Awareness of industry related security standards such as ISO 27000 series, PCI DSS, COBIT, NIST, OWASP.
- Certifications in security management eg. CISSP / CISM / CCSP or equivalent.
- Certifications in technical security domains eg. CEH / OSCP or equivalent.
- Experience of Public and or Private cloud environments.
About us
Our focus is to ensure we're inclusive every day, building an organisation that reflects modern society and celebrates diversity in all its forms. We want our people to feel that they belong and can be their best, regardless of background, identity or culture. We were one of the first major organisations to set goals on diversity in senior roles. And it’s why we especially welcome applications from under-represented groups. We’re disability confident. So, if you’d like reasonable adjustments to be made to our recruitment processes, just let us know.
Joining the Security Consultancy & Design team is an exciting opportunity to contribute to the resilience of the UK's largest retail bank. As a security consultant, you become an integral part of our journey, fostering collaboration and innovation. Our community is growing, and we continue to seek qualified individuals to join us as security consultants. If you are a skilled professional with expertise in cyber security, risk management, security design and threat analysis, we invite you to explore the numerous security consultant positions we have available
· Experience in DevSecOps Tooling/processes (K8, Harness, Terraform, GitHub, SAST/DAST, SDLC)