{"id":3347989,"url":"https://alion.io/job/treatwell-senior-application-security-engineer","title":"Senior Application Security Engineer","company":{"id":172493,"name":"Treatwell","domain":"treatwell.co.uk","url":"https://alion.io/company/treatwell","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":92,"open_postings":36,"ghost_share":0,"stale_share":0.333,"repost_share":0,"time_to_fill_p50_days":40,"computed_at":"2026-11-01T06:10:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["ES"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":47000,"max_usd":109000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon EKS","optional":false},{"name":"ArgoCD","optional":false},{"name":"AWS","optional":false},{"name":"Datadog","optional":false},{"name":"DefectDojo","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitLab CI","optional":false},{"name":"Human-in-the-Loop","optional":false},{"name":"Java","optional":false},{"name":"Kotlin","optional":false},{"name":"Kubernetes","optional":false},{"name":"Magic","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"PHP","optional":false},{"name":"Ruby","optional":false},{"name":"Ruby on Rails","optional":false},{"name":"Spring Boot","optional":false},{"name":"Swift","optional":false},{"name":"TypeScript","optional":false},{"name":"GDPR","optional":true},{"name":"PCI DSS","optional":true},{"name":"Spring Security","optional":true}],"status":"live","first_seen_at":"2026-10-27T17:47:19Z","employer_posted_date":"2026-10-27","last_verified_at":"2026-11-01T22:34:59Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"Senior Application Security Engineer\n We are hiring a Senior Application Security Engineer to own application security across Product Engineering and make Treatwell's products secure by default. You own the security tooling, from SAST in the pipelines to DefectDojo, you are the first call when an application-layer incident needs a security engineer, and you work hands-on with the teams that build our products: pairing with their engineers to fix what the scanners, the annual pentest and real incidents find, closing the design gaps behind them, and sometimes picking up a specific security epic for a product such as Connect or Salonized. Each time, the team ends up able to do the next one without you.\nThis is a hands-on role. You will write code, read a great deal more of it, and own the security tooling in our pipelines. Our applications are Java and Spring Boot across Marketplace and Payments, Ruby on Rails in our SaaS products, React and TypeScript on the web, native iOS and Android apps in Swift and Kotlin, and a small amount of PHP. Marketplace and Connect ship through GitLab CI and ArgoCD onto Kubernetes (EKS) in AWS; Salonized ships through GitHub Actions. Everything is monitored in Datadog, and findings from secrets detection, dependency scanning and SAST flow into a self-hosted DefectDojo.\nThis is application security, not infrastructure security: cloud, Kubernetes and network controls sit with our Developer Experience and Platform Core teams, and you work alongside them. You report to the Head of Developer Experience and set your own security roadmap with the Heads of Engineering, aligned to the OWASP ASVS and the OWASP DevSecOps Maturity Model. We have no CISO: you present the security posture to the CTO and VP of Engineering on a fixed cadence, and your view carries weight because it comes from the code.\nHow you will work\nCross-area by default. The security tooling, the findings pipeline and application-layer incident support are yours across all of Product Engineering. When a product needs focused work, such as a security epic for Connect or Salonized, you pick it up with that team, agreed with its Head of Engineering. Infrastructure security stays with Developer Experience and Platform Core.\nFix with the team, not for the team. You pair on remediation and the team's engineers merge the fix, so the knowledge stays where the code lives.\nGuardrails over gates. The default is a secure path that is quicker to use than to bypass: shared libraries, pipeline templates, pre-commit checks. Blocking is reserved for critical findings on new code and agreed with the area.\nOne queue. Findings land in DefectDojo and move into the team's backlog or Now/Next like any other work. There is no parallel security process.\nThrough the champions. You work with each team's Security Champion and the Security Champions guild. In eighteen months a threat model or an incident should not need you in the room.\nYour own roadmap. You keep a short Now/Next/Later for security, agreed each quarter with the Heads of Engineering, separate from the DevX roadmap.\nPosture, not paperwork. You present the security posture per area to the CTO and VP of Engineering on a fixed cadence, measured against the DevSecOps Maturity Model.\nYou will be responsible for:\nOwning application security across Product Engineering and working hands-on with the teams to remediate vulnerabilities in our codebases, from authentication and session handling to payments flows and public APIs, including specific security epics for a product such as Connect or Salonized.\nOwning the security tooling across all areas (secrets detection, dependency scanning, SAST, DefectDojo, threat modelling) and landing SAST in our pipelines: completing the proof of concept with the SAST vendors we are evaluating on two pilot teams, the Marketplace Checkout and Identity team and a SaaS team, tuning rules until engineers trust the output, and feeding every finding into DefectDojo rather than a new dashboard.\nMaking DefectDojo work without a human in the loop: team ownership synced from our service catalogue, every team's repositories covered, and an agreed rule for which findings block a pipeline and which only report.\nBuilding secure defaults into the paved road so the secure way is the easy way: authentication and session libraries, input validation, secrets handling, dependency and container checks in the pipeline templates teams already use.\nRunning threat modelling with teams before the work is fully scoped, using and improving our AI-based threat modeller so that it answers an engineer's question plainly and produces backlog items with owners and dates.\nTriaging findings from scanners, the annual penetration test and external reports, agreeing severity and ownership with the team, and tracking them to closure in DefectDojo against our severity SLAs.\nBeing the first security call for application-layer incidents across Product Engineering: leading the technical side, assessing with Legal whether personal data was exposed, writing the postmortem actions, and working with Customer Support and Payments on fraud and customer-flagged cases including phishing.\nOwning our security vendor relationships: the annual penetration-test cycle with our testing partner (scoping, scheduling, remediation planning), the responsible-disclosure programme and the security@ inbox, and the SAST vendor once selected.\nActing as the security reviewer in our third-party risk process for new vendors and integrations, and answering the security questionnaires our partners send us.\nMeasuring the security posture per area against the DevSecOps Maturity Model and presenting it to the CTO and VP of Engineering on a fixed cadence.\nGrowing the Security Champions programme with the Head of Developer Experience: a named champion in every team, demo-led guild sessions, and two security improvements per area shipped through team backlogs each quarter.\nKeeping a short, current security roadmap (Now/Next/Later), agreed with the Heads of Engineering each quarter and visible to Product Engineering.\nAbout you\nYou have worked as an application security engineer, or as a backend engineer who owned security for a product, and you fix vulnerabilities yourself rather than only reporting them.\nYou read and write production code in at least one of our languages (Java, Ruby, TypeScript) well enough to pair on a fix, review a merge request and spot the second bug behind the first.\nYou know the OWASP ASVS and Top 10 from code rather than slides, and you can run a threat model that ends in backlog items rather than a document.\nYou have put SAST, dependency scanning or secrets detection into CI pipelines (GitLab CI or GitHub Actions) and tuned the rules so developers kept trusting them.\nYou have worked with a vulnerability management platform and you know how to keep a finding moving to closure without chasing people by hand.\nYou understand how authentication, sessions, authorisation and payments flows break in practice: IDOR, token and magic-link misuse, JWT validation mistakes, race conditions, injection, and the odd device-id collision.\nYou know enough AWS and Kubernetes to see where application security meets the platform, and when to hand a problem to the platform team instead.\nYou explain risk in plain language to engineers, Heads of Engineering and non-technical leaders, and you can say \"this one is fine\" as clearly as \"this one is not\".\nYou transfer skills on purpose: your measure of success is a team that does not need you for the next one.\nYou use AI tooling as a normal part of the work, for threat modelling, code review and reading unfamiliar codebases, and you know where it is wrong.\nNice to have\nExperience in a marketplace, payments or SaaS business handling card data and personal data under PCI DSS and GDPR.\nA bug bounty, CTF or penetration-testing background, or an offensive certification such as OSCP, OSWE or BSCP.\nRunning or scaling a Security Champions programme.\nFamiliarity with the OWASP DevSecOps Maturity Model or another maturity framework.\nHands-on time with WAF and bot protection, secrets management, and infrastructure-as-code scanning, ideally in AWS.\nSpring Security or Rails security internals; writing custom SAST rules.\nWe’ll treat you with:\n28-days holiday, plus bank holidays \nMonthly €40 Treatwell vouchers so you can treat yourself too \nMental health support through our partnership with Open-Up \nMarket-specific benefits that will be discussed in the interview process\nEqual Opportunities\nTreatwell is an 'Open to All' employer and warmly welcomes everybody to the team. We are committed to making reasonable adjustments to the recruitment process as required. Please add any adjustment requests to your application.","description_format":"text","description_chars":8777,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Spain","iso":"ES","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Marketplaces","Scheduling & Booking Software"],"lifecycle":[{"event":"open","at":"2026-10-27T17:47:19Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":4,"expected_fill_days":40,"reasons":["conf:3","win:early"],"computed_at":"2026-11-01T06:10:25Z"},"pay":null,"html_url":"https://alion.io/job/treatwell-senior-application-security-engineer","json_url":"https://alion.io/job/treatwell-senior-application-security-engineer.json","meta":{"generated_at":"2026-11-01T23:01:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":35037,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":172493},"rest":"https://alion.io/mcp/rest/get_company?id=172493"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftreatwell-senior-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftreatwell-senior-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftreatwell-senior-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/treatwell-senior-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftreatwell-senior-application-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3347989}},{"tool":"search_jobs","arguments":{"company":"treatwell.co.uk","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3347989},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}