Application Security Engineer

PEI Group

About The Position

The security team monitors and supports PEI Media’s security control framework and works with third parties to deliver security services. As part of IT, the team reports to the Executive team and engages with stakeholders across the business. The Application Security Engineer works closely with the Information Security and Governance Manager, providing security services primarily to the IT, Product, Engineering, and Cloud Platform teams. Much of the role focuses on vulnerability management and supporting engineers in delivering secure products and infrastructure.

Requirements

At least 2 years of demonstrable understanding of AWS architecture, services, and security best practices.
At least 2 years of practical experience understanding vulnerability management programmes.
Ability to communicate the impact of security vulnerabilities to executives or engineers.
Ability to scope penetration tests effectively and engage with partners in their execution.
Ability to articulate security use cases to project or sprint team leads.
Practical understanding of the OWASP methodology for securing code.
Practical understanding of the configuration and outputs of vulnerability management tools, specifically AWS Inspector, Rapid7 Command Centre or similar, Snyk, and SonarQube/SonarCloud.
Up-to-date knowledge of generative AI platforms and large language models, their use cases, and security best practices.
Confidence with infrastructure as code.
Strong problem-solving skills and curiosity about how things work.
Good verbal and written communication skills, with the ability to engage colleagues at all levels.
Genuine appetite for learning unfamiliar platforms.

Nice To Haves

Practical understanding of security quality gates for continuous delivery and how tooling can improve the quality of code in production.
At least 2 years of demonstrable understanding of Azure architecture, services, and security best practices.
Understanding of securing Databricks configuration.
Experience working with AI coding assistants and agents; an appetite for using them is also valued.

Responsibilities

Manage the Vulnerability Management Programme, ensuring appropriate coverage and reporting to help prioritise vulnerability fixes.
Collaborate with teams to give them the information they need to resolve security issues.
Work with third parties to deliver a penetration testing programme covering critical assets.
Operate security tooling, ensuring it works correctly and is configured to provide relevant outputs to the appropriate teams.
Provide security assurance during system and application design, ensuring products reflect security requirements and that those requirements are delivered.
Provide security input to disaster recovery plans and tests.
Offer teams ad hoc advice on security issues as they arise.

Benefits

25 days of annual leave plus 8 bank holidays, with additional leave for long service and a gifted Christmas break.
10 days of rolling sick leave.
Option to buy or sell up to 3 days of leave.
Employee incentive reward program tied to future exit events.
4 paid volunteer days per year.
On-site 24/7 gym with classes and full facilities.
Life insurance worth 4 times basic salary.
24/7 Employee Assistance Programme.
Private medical insurance after probation.
Annual eye tests and DSE eyewear allowance.
Pension scheme with 4.5% matched contributions and enhanced matching over time.
Cycle to work scheme.
Interest-free travel loan.
Employee referral bonus.