Senior Application Security Consultant (SAST/DAST/OWASP )
First seen by Alion on Jul 30, 2026. Salt scores A on the Alion truth index.
Secure SDLC | SAST | DAST | Threat Modelling | Cloud Security | CI/CD
Location: London (Hybrid - 8 days onsite per month)
Contract: 12 Months + extension
Rate: £500-£550 per day (Umbrella)
The Opportunity
We’re looking for an experienced Senior Application Security Consultant / DevSecOps Security Architect to join a high-performing Cyber Security function within a large enterprise technology environment.
Working alongside software engineering, cloud, architecture and DevOps teams, you’ll play a key role in embedding security throughout the Software Development Lifecycle, ensuring applications are designed, developed and deployed securely.
This is an excellent opportunity for someone passionate about Secure-by-Design, DevSecOps and modern Application Security within a large-scale cloud environment.
Key Responsibilities Lead application security reviews across business-critical applications and cloud platforms.
Conduct security architecture and secure design reviews.
Perform application security risk assessments and define security requirements.
Lead Threat Modelling workshops using STRIDE, MITRE ATT&CK or similar methodologies.
Embed Secure SDLC principles into engineering teams.
Integrate security tooling into CI/CD pipelines and DevSecOps processes.
Review and analyse SAST, DAST and Software Composition Analysis (SCA) findings.
Work closely with development teams to prioritise vulnerability remediation.
Define security testing requirements and support penetration testing activities.
Produce security standards, technical guidance and best practice documentation.
Act as the Application Security SME across multiple technology programmes. Essential Skills
Application Security Secure Software Development Lifecycle (SSDLC)
OWASP Top 10
Secure Coding
Secure Design Reviews
API Security
REST APIs
Microservices Security
Application Security Risk Assessments Threat Modelling STRIDE
MITRE ATT&CK
Security Architecture
Risk Assessments DevSecOps CI/CD Security
GitHub Actions
GitLab
Jenkins
Azure DevOps
Security Automation
Shift Left Security Security Testing SAST
DAST
SCA
Vulnerability Management
Penetration Testing Cloud Security AWS, Azure or GCP
Kubernetes
Docker
Container Security
Cloud Security Best Practices Security Tooling
Experience with one or more of: Checkmarx
Fortify
SonarQube
Veracode
Semgrep
Burp Suite
OWASP ZAP
Snyk
Trivy
Prisma Cloud
Aqua
Wiz Ideal Background
You’ll ideally have: 8+ years in Cyber Security
Strong Application Security or DevSecOps experience
Experience working directly with software engineering teams
Experience embedding security into CI/CD pipelines
Strong knowledge of Secure SDLC
Experience conducting Threat Modelling sessions
Excellent stakeholder management and communication skills
Previous experience within Banking, Financial Services, Insurance or another highly regulated enterprise environment Contract Details 12-month contract
£500-£600 per day (Umbrella)
Hybrid working - 8 days onsite per month in London
Immediate interview availability preferred *Rates depend on experience and client requirements