Application Security Engineer
Centrica plc1 day ago
Windsor, CanadaSenior
Responsibilities
- Embed security best practices into the software development lifecycle with DevOps and engineering teams.
- Provide guidance on secure design, implementation, architecture, API security, microservices, and cloud-native application security.
- Conduct manual security assessments and coordinate third-party security engagements.
- Review SAST, DAST, and SCA results and drive vulnerability remediation through closure.
- Provide application security support and improve security processes, tooling, and ways of working.
- Lead or contribute to the Security Champions programme.
- Collaborate with GSOC and CSIRT teams on application-layer security incidents.
- Support security automation, custom rule development, supply-chain security, container scanning, SBOM tooling, infrastructure-as-code security, policy as code, and threat modelling.
Requirements
- Strong hands-on application security experience and knowledge of secure software development, OWASP Top 10, application vulnerabilities, and secure SDLC practices.
- Proficiency in one or more programming languages such as Python or JavaScript, including using code for security automation or tooling.
- Experience with cloud platforms such as AWS, Azure, or SAP.
- Understanding of container security, API security, network protocols, and identity frameworks including OAuth 2.0, OIDC, and SAML.
- Working knowledge of DevOps pipelines, repositories, and CI/CD security integration using platforms such as Azure DevOps and GitHub Actions.
- Experience with SAST, DAST, SCA, container scanning, vulnerability management, CycloneDX, Terraform, Bicep, Ansible, Trivy, policy as code, and threat modelling.
- Ability to guide engineering teams, support third-party supply-chain security, and communicate complex security topics practically.
- Desirable qualifications include GWAPT, GWEB, OSCP, or AWS Security Specialty certifications, plus experience with Security Champions, developer training, SOC, or incident response.
Benefits
- UK-based hybrid working with occasional travel to site.
- Market salary and growth opportunities.
- 15% Employee Energy Allowance.
- Company pension plan and fully funded healthcare plan.
- 25 days of holiday plus public holidays, with the option to purchase up to five additional days.
- Flexible benefits including technology benefits, eco-friendly car leases, and travel insurance.
About Centrica plc
Centrica plc supplies gas, electricity, and related services to homes and businesses, primarily in the UK and Ireland, through brands such as British Gas and Bord Gáis Energy. It also trades energy, manages storage and distributed energy assets, and provides home services and connected-home technology. Headquartered in Windsor, Berkshire, the company was created in 1997 from the demerger of British Gas and is listed on the London Stock Exchange.