[Hiring] Application Security Engineer @PEI Group

Role Description

The security team monitors and supports the security control framework for PEI Media; and engages with third parties to deliver security services in support of that framework. As an Application Security Engineer, you will work closely with the Information Security and Governance Manager to provide security services to the business units, predominantly the IT, Product, Engineering and Cloud Platform teams.

A good share of the work sits around the Vulnerability Management Programme and supporting coders/engineers to deliver secure products and infrastructure.

Responsibilities and Duties

• Manage the Vulnerability Management Programme.
• Ensure relevant coverage and reporting to prioritize vulnerability fixes.
• Collaborate with teams to provide necessary information to solve problems.
• Work with third parties to deliver a Penetration Testing programme against critical assets.
• Operate the security tooling that supports the security programme.
• Ensure tooling operates correctly and is configured to provide relevant outputs.
• Provide security assurance in system and application design.
• Work with delivery teams to ensure products reflect security requirements in the design stage.
• Provide security input to disaster recovery plans and tests.
• Support teams who depend on us by providing ad-hoc advice on security issues.

Qualifications

• A demonstrable understanding over at least 2 years of AWS architecture and services, and security best practices within this environment.
• Practical experience over at least 2 years of understanding vulnerability management programmes.
• A demonstrable ability to communicate the impact of security vulnerabilities to execs or engineers.
• A demonstrable ability to effectively scope Penetration tests and engage with partners in their execution.
• A demonstrable ability to articulate security use cases to Project/Sprint team leads.
• Desirable: A practical understanding of security quality gates for Continuous Delivery in engineering practices.
• Desirable: A demonstrable understanding over at least 2 years of Azure architecture and services; and security best practices within this environment.

Technical Skills

• A practical understanding of the OWASP methodology for securing code.
• A practical understanding of the configuration and outputs from vulnerability management tooling, specifically AWS Inspector, Rapid 7 Command Centre (or similar), Snyk and Sonarqube/Sonarcloud.
• Up to date knowledge of Generative AI platforms/Large Language Model and their associated use cases and security best practices.
• Confident with infrastructure as code.
• Desirable: An understanding of securing DataBricks configuration.
• Desirable: Experience of working with AI coding assistants and agents.

Personal Attributes

• Strong problem solving and real curiosity about how things work.
• A good communicator whether verbally or written, able to engage with colleagues of all levels.
• A genuine appetite for learning unfamiliar platforms.

Benefits

• 25 days of annual leave plus 8 bank holidays, with additional leave for long service and a gifted Christmas break.
• 10 days rolling sick leave.
• Holiday flex option to buy or sell up to 3 days of leave.
• Employee incentive reward program (EIRP) tied to future exit events.
• 4 paid volunteer days per year.
• On site 24/7 gym with classes and full facilities.
• Life insurance (4x basic salary) and 24/7 Employee Assistance Programme.
• Private medical insurance (post-probation), annual eye tests and DSE eyewear allowance.
• Pension scheme with 4.5% matched contributions and enhanced matching over time.
• Cycle to work scheme, interest-free travel loan and employee referral bonus.