{"id":858980,"url":"https://alion.io/job/flagstoneim-senior-application-security-engineer","title":"Senior Application Security Engineer","company":{"id":694494,"name":"Personal","domain":"flagstoneim.com","url":"https://alion.io/company/flagstoneim","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":89000,"max_usd":164000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":29},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"STRIDE","optional":false}],"status":"live","first_seen_at":"2026-05-13T14:31:49Z","employer_posted_date":"2026-05-13","last_verified_at":"2026-10-14T12:46:03Z","board_verified":true,"closed_at":null,"days_open":154,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":153},"description":"What is Flagstone?\nFlagstone is many things. An online savings platform, reinventing how individuals, businesses, and charities manage, protect, and grow their cash. A diverse group of people, bound by a collaborative spirit, and shared purpose. And lastly, a thriving, profitable business - where smart people do their best work.\nEach definition shares a common thread: our unique culture. It’s our pride and joy. And our competitive advantage.\nA feel for our culture:\nTo revolutionise the savings market, we need to be at our best. But high performance takes more than talent - it takes a culture of kindness, respect, and growth.\nThat’s why we’re building a diverse, inclusive community, where your voice is heard and valued. Where, with close support and room to develop, you can surpass even your own expectations. And be rewarded for it.\nWe may not change the world, but we can change the world of financial technology. And all it takes is a winning mix of drive, talent, and empathy. Our culture celebrates all three.\nBut enough about us. Let’s talk about you.\nAbout the Team\nThis is a new AppSec-focused addition to Security Engineering, working closely with product engineering teams across the SDLC. The role sits alongside, not inside, GRC/Compliance - customer security questionnaires and RFP responses are owned by GRC, with this role providing technical input as needed rather than end-to-end ownership.\nDoes this sound like you:\nWe're currently hiring a Senior Application Security Engineer to own AppSec end-to-end across our development lifecycle: from design-stage threat modelling through to code review, tooling, and remediation of findings. This is a hands-on engineering role, not a compliance or customer-facing one - you'll work directly with product engineering teams to build security in rather than bolt it on afterwards.\nWhat you’ll do:\nOwn the AppSec programme for Flagstone and report back on its success to relevant stakeholders including leadership\n\nFormalise a secure development lifecycle which includes owning threat modelling and secure design review for new features and systems, working directly with engineering teams during design rather than after the fact, introducing security gates and guardrails and ensuring applications are secure even post deployment\n\nRun and continuously improve secure code review practices, including SAST/DAST/SCA tooling integrated into CI/CD pipelines and code review (manual and/or AI assisted)\n\nCoordinate external and execute internal penetration test engagements - scope, logistics, findings triage - and drive remediation to closure with engineering teams\n\nMaintain and evolve secure coding standards, and run a security champions programme to scale AppSec practice across engineering\n\nTrack and report on vulnerability management across the application estate, prioritising by exploitability and business impact\n\nContribute AppSec expertise to incident response where application-layer issues are involved\n\nRun and own a security champions programme\n\nManage application cyber risk according to the internal Flagstone Risk Framework\n\nWhat we’re looking for\n5+ years in application security or a security engineering role with a strong AppSec component\n\nPractical experience embedding security in the SDLC: threat modelling frameworks (e.g. STRIDE), secure design review, and working directly with engineering teams\n\nHands-on experience with SAST/DAST/SCA tooling and CI/CD pipeline integration\n\nStrong grasp of OWASP Top 10 and secure coding practices across at least one major language/framework used in a production environment\n\nExperience coordinating and running penetration testing programmes, including remediation tracking\n\nComfortable communicating security risk clearly to engineering and product audiences and influencing senior leadership\n\nDemonstrable experience with adversarial security testing\n\nDemonstrated experience in reviewing, threat modelling and securing agentic and AI systems\n\nGreat communication skills and stakeholder management, which includes influencing stakeholders and creating relationships\n\nStrong critical thinking skills and a curiosity for learning new technologies and frameworks\n\nGreat at troubleshooting and thinking out of the box\n\nNice to Have\nA strong link to the AppSec community and industry which includes conferences, OWASP or other Open-Source contributions, public speaking and engagement in thought leadership\n\nOSCP, CSSLP, or equivalent hands-on offensive/AppSec certification\n\nExperience in a regulated financial services environment\n\nPrior experience running or scaling a security champions programme\n\nExposure to cloud-native application security (containers, serverless, API security)\n\nHow we reward you:\nAt Flagstone, the benefits extend beyond false gifts like “fruit and snacks”. Instead, we invest in your health, wealth, and professional development. Here’s a selection of our benefits:\nCompetitive bonus scheme - designed to reward and recognise high performance\n\nFlexible benefits budget - a pot to fund meaningful benefits for you, whether it's hormone or fertility testing, cancer screening, neuro-diversity coaching or something that matters for you.\n\nA range of salary sacrifice options to help you make tax efficient savings on electric cars, nursery schemes, home and tech goods.\n\nAround the World scheme - 3 months work from anywhere scheme (some exclusions do apply)\n\nMental wellbeing support - Access therapy and mental health sessions through Spill\n\nLearning and development - £1,000 personal development budget to help you grow in your role.\n\nPrivate health care - Enjoy all the benefits AXA has to offer, including reduced gym memberships and medical history disregarded\n\nMedical cash plan - To help you with the costs of dental and optical expenses\n\nLife insurance and Income Protection- four times your annual salary for peace of mind\n\nMatched pension contributions up to 5%\n\n25 days holiday - plus bank holidays, well-being days and volunteering days\n\nEnhanced Parental Leave - enhanced maternity, paternity and adoption pay.\n\nAll are welcome.\nAt Flagstone, we’re assembling a diverse team that defies our industry’s norms. Think this role could suit you? We encourage you to apply, no matter your background.","description_format":"text","description_chars":6262,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Gym membership","Life insurance","Parental leave","Professional development"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Investing Apps & Robo-Advisors"],"lifecycle":[{"event":"open","at":"2026-09-13T08:41:27Z"}],"visa":[],"liveness":{"score":19,"band":"cold","label":"Long shot","p_open":1,"p_active":0.684,"p_room":0.28,"age_days":153,"expected_fill_days":64,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/flagstoneim-senior-application-security-engineer","json_url":"https://alion.io/job/flagstoneim-senior-application-security-engineer.json","meta":{"generated_at":"2026-10-14T16:15:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":20619,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":694494},"rest":"https://alion.io/mcp/rest/get_company?id=694494"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fflagstoneim-senior-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fflagstoneim-senior-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fflagstoneim-senior-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/flagstoneim-senior-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fflagstoneim-senior-application-security-engineer"}]}