About this role
Salary: £42,000 - 76,000 per year
Requirements
- Were looking for an experienced application security professional with a strong understanding of Secure by Design, threat modelling, application security testing, vulnerability management and security risk assessment.
- Experience in an application security, product security or secure software engineering role.
- Practical understanding of common web application and API security risks, including authentication, authorisation, input handling, data protection and security misconfiguration.
- Experience reviewing application designs or data flows and facilitating threat modelling using STRIDE or a comparable approach.
- Experience using or interpreting application security testing results, such as SAST, software composition analysis, API testing, secrets detection, or infrastructure and container configuration scanning.
- Ability to triage findings based on exploitability, impact and business context, and explain remediation clearly to developers.
- Familiarity with modern software delivery and cloud environments, such as CI/CD, AWS, containers and orchestration platforms.
- Strong communication skills and the judgement to distinguish advice, required controls and risks that need escalation.
- Experience with Java/Spring Boot, React/Node.js, Snowflake, Salesforce, Kubernetes/OpenShift, Snyk or Wiz would be useful. Equivalent experience with other languages, cloud platforms and security tools is welcome.
Responsibilities
- Provide hands-on application security engineering for our Customer B2C and Connected Mobility domains during a 12-month cover period, reporting to the Security Engineering Team Lead.
- Work with product teams, engineers and architects to identify and reduce security risk throughout design, development, testing and release.
- Act as the day-to-day application security contact for these domains, working within our wider Security Engineering function and escalating risks to appropriate security and business owners.
- Help teams build and improve security controls in their delivery processes and reduce identified vulnerabilities.
- Engage with product and delivery teams early to understand systems, data, users and business context.
- Review solution architectures and data flows, facilitate threat modelling, and turn findings into clear, prioritised security requirements.
- Provide practical advice on secure design and implementation for applications, APIs, cloud services and integrations.
- Help teams use and improve automated security checks in development and CI/CD workflows, including code, dependency and configuration checks where relevant.
- Triage findings based on risk and context, explain remediation options, and work with engineering teams to verify fixes.
- Coordinate penetration testing and track material findings through remediation and retesting.
- Assess the security of SaaS platforms, external APIs and OEM integrations in collaboration with relevant teams.
- Work with Security Operations, IAM and Cloud Security to coordinate controls, monitoring and response when application risks cross team boundaries.
- Represent project security positions at the Cyber Security Technical Working Group, working with Solution Architects and escalating decisions beyond your delegated authority.
- Contribute to improvements in application security standards, secure development practices and our product maturity security strategy.
- Maintain clear records of advice, decisions, findings and exceptions, and provide a practical handover at the end of the fixed-term period.
Technologies
- API
- AWS
- CI/CD
- Cloud
- IAM
- Java
- Kubernetes
- OpenShift
- REST
- React
- Salesforce
- Security
- Snowflake
- Spring
- Spring Boot
- Web
- NodeJS
- Support
- Network
More
We are Motability Operations, a purpose-led organisation with a commercial focus, providing worry-free mobility solutions to more than 800,000 customers and their families across the UK. Customers exchange their higher-rate mobility allowance to lease affordable vehicles, including cars, wheelchair-accessible vehicles, scooters and powered wheelchairs, with insurance, maintenance and breakdown assistance included. We are the UKs largest car fleet operator, work with around 5,000 car dealers and all major manufacturers, and have an independently verified customer satisfaction rating of 9.8 out of 10.
Our values are We find solutions, We drive change and We care. This is a 12-month cover role within our Security Engineering function. We work in a hybrid model, with colleagues based in the UK able to work remotely up to two days per week and spend the rest of their time at our offices. Our benefits include an annual discretionary bonus, a non-contributory pension, life assurance, employee and vehicle discount schemes, a Cycle to Work Scheme, 28 days annual leave with options to purchase or sell days, private medical and critical illness cover, healthcare apps, health screening, a paid volunteering day, and access to an accessible company allotment, prayer room and quiet spaces.
Optional benefits include dental insurance, additional health and cancer screenings, discounted gym memberships and charitable giving. We are committed to an inclusive workplace where people can be themselves and are rewarded equally. Our offices provide disability access, and we consider part-time and flexible working requests where possible. We may bring forward the vacancy closing date if we receive enough suitable applications.
last updated 46 week of 2026