Application Security Engineer

At OakNorth, we're on a mission to empower ambitious businesses and the communities they serve. Since 2015, we've lent over $21 billion across the UK and US, helped create more than 58,000 new homes and 36,000 new jobs, and supported hundreds of thousands of personal savers — all while driving economic growth in the markets we serve.

The Application Security Engineer is a hands-on, full-stack security role focused on fixing the hardest application and AI security problems — particularly those that cross team boundaries or involve architecture, authentication, and authorisation that automation cannot yet safely resolve. You'll take remediation load away from engineering teams so they can stay focused on delivery, working closely with the teams that detect, prioritise, and track vulnerabilities. You'll also contribute to the development of OakNorth's internal coding agent platforms, so security fixes can scale safely.

WHAT YOU'LL DO

Fix complex application security vulnerabilities directly, including architectural weaknesses and issues in legacy technology that automated remediation cannot yet handle safely.

Lead remediation of problems that cross team and system boundaries, coordinating changes across multiple owners and services and seeing them through to resolution.

Resolve authentication and authorisation weaknesses, including identity, access control, session and token handling, service-to-service trust and permission models.

Act as a dedicated delivery vehicle for security remediation, reducing the fix burden on engineering teams so they can focus on product delivery.

Interpret the output of security tooling (e.g., SAST, DAST, SCA, secrets, container and IaC scanning), validate findings, identify root causes and implement the right fix rather than only triaging.

Secure agentic and AI-enabled systems, assessing and mitigating risks such as those in the OWASP Top 10 for Agentic Applications, including prompt injection, excessive agent permissions, tool misuse, insecure agent-to-agent communication and unsafe handling of agent outputs.

Contribute to the development of our internal coding agent platforms, including remediation agents, by supplying specialist fixes, remediation patterns, evaluation cases and feedback on where agents succeed or fail.

Define and build guardrails for agent-generated and human-written changes (e.g., least-privilege agent access, human approval points, secure defaults, shared libraries, pipeline checks and policy-as-code) so that changes are safe and vulnerabilities do not recur.

Build and secure GitHub workflows and release pipelines, including GitHub Actions hardening, secrets and token handling, branch protection, dependency and supply chain controls, and security gates in CI/CD.

Plan and deliver higher-risk changes safely, including testing, peer review, rollout and rollback approaches, in partnership with the teams that own the systems.

Work with the teams that detect, prioritise and track vulnerabilities to take prioritised findings through to remediation, and identify recurring fix types that can be automated safely.

Document remediation approaches, share knowledge and coach engineers on secure design, secure coding and the safe use of AI coding agents.

Report on remediation progress, including backlog reduction, SLA performance and risk reduction, and provide evidence to support audit and regulatory requirements.

YOU'LL BE A GREAT FIT IF YOU HAVE...

Engineering Skills

Full stack engineering experience across front end, back end and APIs, with proficiency in one or more languages (e.g., Java, Python, C#, JavaScript/TypeScript) and the ability to work in unfamiliar and legacy codebases.

Strong hands-on experience with GitHub (pull requests, code review, branch protection, code scanning) and GitHub Actions, including building and securing release pipelines.

Working knowledge of cloud platforms, containers and infrastructure as code.

Ability to review code, find vulnerabilities and implement practical, correct fixes.

Application Security Skills

Strong application security knowledge, including the OWASP Top 10 and common vulnerability classes such as injection, broken access control, insecure deserialization and cryptographic weaknesses.

Deep understanding of authentication and authorisation, including OAuth 2.0, OIDC, SAML, JWT and session handling, RBAC/ABAC models and service-to-service identity.

Hands-on experience interpreting application security tooling output (SAST, DAST, SCA, secrets, container and IaC scanning), distinguishing true and false positives and finding root cause.

Understanding of CI/CD and software supply chain security, including GitHub Actions risks such as untrusted input, over-privileged tokens and third-party action pinning.

AI & Agentic Security Skills

Day-to-day experience using coding agents such as Claude to write, review and fix code, with sound judgement on where they are reliable and where they are not.

Knowledge of and informed opinions on the OWASP Top 10 for Agentic Applications and related AI security risks, including prompt injection, tool and permission abuse, data leakage and agent identity.

Ability to design guardrails, permission boundaries and evaluation approaches for AI agents and agent-generated changes.

Ability to turn manual fixes into repeatable patterns and test cases that agent platforms can use.

Remediation & Architecture Skills

Experience fixing architectural and design-level security issues, and making safe changes in systems with limited tests, documentation or clear ownership.

Ability to plan and deliver changes that span multiple teams and services, managing dependencies and risk.

Sound judgement on testing, rollout and rollback for higher-risk changes.

Collaboration & Communication Skills

Ability to work as a trusted partner to engineering teams, explaining why a fix is needed and making it easy to adopt.

Influence without direct authority across teams that own the affected systems, including stakeholders in different locations and time zones.

Clear written and verbal communication, including documentation and progress reporting.

Mindset & Attributes

Ownership and a bias to action: comfortable taking on ambiguous, hard problems and seeing them through to resolution.

Pragmatic, risk-aware judgement when balancing speed of remediation against the risk of change.

Curiosity and continuous learning as threats and agentic technologies evolve.