Application Security Engineer

Health Hero
W1T1Af, W1T 1AF, United Kingdom
5 days ago
Job Type
Contract
Work Pattern
Part-time
Work Location
Hybrid
Seniority
Mid
Education
Degree
Posted
26 May 2026 (5 days ago)

Application Security Engineer (London or Bristol)

We are HealthHero, Europe’s largest digital clinic. Join us at a pivotal moment as we scale our digital healthcare platform across Europe — giving you the chance to shape security at the heart of a fast-growing, AI-driven business. We are recruiting an exciting Application Security Engineer on an initial 12 month fixed term contract, with a view to becoming permanent – based in either our London or Bristol office two days per week.

About the role

You will own security across the software development lifecycle, embedding automated security testing into CI/CD pipelines and enabling development teams to ship secure code quickly. This role works closely with UK and France engineering teams.

As an experienced Application Security Engineer, your working day will include but not be limited to:

DevSecOps & Pipeline Security

  • Implement and maintain security testing in GitLab CI pipelines
  • Configure and tune SAST, DAST, dependency scanning, and secrets detection
  • Build automated security gates that balance rigour with delivery velocity
  • Enable self-serve security tooling for development teams
  • Contribute code and patches to security tooling and configurations

Secure Development

  • Define and enforce secure coding standards
  • Conduct security-focused code reviews and threat modelling for new features
  • Provide remediation guidance for application vulnerabilities
  • Train and support developers on secure coding practices

Vulnerability Management

  • Triage, patch and track application vulnerabilities through to remediation
  • Manage dependency vulnerabilities and upgrade cycles
  • Report on application security posture to senior leadership

Risk & Compliance

  • Embed GDPR and healthcare regulatory requirements into development processes
  • Support DCB0129 clinical safety compliance for software changes
  • Support customer security due diligence and audits
  • Support ISO27001:2022 ISMS controls and audit process

Key Skills and Experience

Essential:

  • 3+ years in application security, DevSecOps, and secure software development
  • Hands-on experience with CI/CD security integration (GitLab CI or similar)
  • Familiarity with SAST/DAST tooling and dependency scanning
  • Understanding of common vulnerabilities (OWASP Top 10) and remediation
  • Previous experience working as a back end or full stack developer
  • Knowledge of GDPR and data protection legislation
  • Strong communicator; able to translate security requirements for developers

Desirable:

  • Development background with security focus
  • Familiarity with SIEM platforms (Snowbit, Splunk, Sentinel)
  • Experience with CSPM tooling (Wiz, Prisma Cloud, or similar)
  • Penetration testing or bug bounty experience
  • Experience in regulated environments (healthcare, financial services)
  • Familiarity with threat modelling frameworks (STRIDE, PASTA)

About us

We exist to simplify healthcare and improve lives by making care feel instant, intelligent and human.

HealthHero is Europe’s largest digital health provider, delivering 4 million consultations per year. But we’re just getting started. We’ve built a seamless digital clinic that brings body and mind together — from GP appointments and mental health support to long-term condition management. By sitting behind the world’s leading insurers and employers and supporting public health systems, we make it easier for millions of people to get the care they need, exactly when they need it.

We are a high-growth, capital-backed business with a sophisticated scale strategy. Our team is a unique blend of those with strong digital experience, management consultants, creatives and industry-leading clinical experts.

We aren’t just digitising appointments; we’re building the next generation of healthcare. We’re creating an AI-powered, always-on ecosystem that learns from every interaction to shift the needle from reactive treatment to proactive, sustainable health. At HealthHero, we are digital when it should be and human where it counts.

Join us, and help build a next generation health system the world is waiting for.

We’re proud to be recognised as a which reflects our commitment to creating a supportive and engaging culture. We have also been featured as the fastest growing digital healthcare company of scale in the first Sunday Times 100 Tech list. This recognition shows our impact in the digital health sector and our dedication to innovation and excellence. Committed to achieving excellence in the delivery of person-centred care, we invest in people, resources and technology to continuously improve the quality of its services and organisational culture.

What we offer

  • A full induction training programme, which will be undertaken via Microsoft Teams.
  • An opportunity to work as part of an experienced team who are passionate in their field, supportive, diverse and dynamic.
  • 25 days leave.
  • Bank Holidays and your birthday off as leave.
  • Regular 1-2-1s with your line Manager.
  • 24/7 on-call staff support.
  • Auto-enrolment pension scheme.
  • Health Scheme and access to our Employee Assistance Programme.
  • Life Insurance Scheme.

Apply

If you are interested in making a difference and believe this role is a good fit for you, we would love to hear from you. If you have any questions, please contact our Recruitment Team at

Hybrid:London or Bristol (There is a requirement to work in the office for a minimum of two days per week)

Closing date for applications: Friday 29 May (5pm)

Additional information

*We reserve the right to close this job in the event we receive a sufficient number of applications.

**Please note that we are unfortunately unable to offer a sponsor licence to candidates who require sponsorship from their employer.

Related Jobs

View all jobs

Security Engineer, Amazon Application Security

Amazon London, United Kingdom
Permanent

Principal Security Engineer, SDO AppSec EMEA

Amazon London, United Kingdom
Permanent

Product Security Engineer

Real Limerick, Limerick County, Ireland
£60 – £78 ph Hybrid

Senior Security Engineer

MUFG Pension & Market Services Leeds, West Yorkshire, United Kingdom
Hybrid

Senior Security Cloud Engineer

Health Hero W1T1Af, W1T 1AF, United Kingdom

Security Engineer - DevSecOps/Code Security

Keystone Recruitment Partners Ltd United Kingdom
£50,000 – £60,000 pa Remote

Industry Insights

Discover insightful articles, industry insights, expert tips, and curated resources.

Where to Advertise Cyber Security Jobs in the UK (2026 Guide)

Where to advertise cyber security jobs UK in 2026: the specialist boards, communities and channels that reach offensive, defensive and GRC security talent. The candidate pool is small, heavily vetted and in high demand across government, financial services, critical national infrastructure and the private sector simultaneously. Many of the strongest candidates hold active security clearances, are not actively job-searching through general platforms, and move primarily through specialist networks and trusted referrals. General job boards reach a broad audience but lack the specificity that security professionals expect. Specialist platforms, government-affiliated channels and cleared candidate networks each serve a different part of the market. This guide, published by CybersecurityJobs.tech, covers where to advertise cyber security roles in the UK in 2026, how the main platforms compare, what employers should expect to pay, and what the data says about hiring across different role types.

Cyber Security Jobs UK 2026: What to Expect Over the Next 3 Years

Cyber Security Jobs UK 2026: roles, salaries and the threat intelligence, cloud security and zero-trust hiring trends shaping UK cyber careers. Cyber security is one of the few sectors where demand for talent has never once dipped. Every major technological shift of the past decade — cloud migration, remote working, AI adoption, the proliferation of connected devices — has expanded the attack surface that security professionals are expected to defend. And every expansion of that attack surface has generated more jobs. But the cyber security jobs market of 2026 is not simply a larger version of what it was three years ago. It is a structurally different market. The threats have evolved, the technologies used to combat them have changed, the regulatory environment has tightened considerably, and the roles being created reflect all of that. A job seeker who understands only the cyber security landscape of 2023 is already working with an outdated map. The candidates who will thrive over the next three years are those who understand where the sector is heading — which specialisms are attracting the most investment, which technologies are reshaping defensive and offensive security practice, and how the definition of a cyber security professional is broadening well beyond the traditional image of a network defender in a SOC. This article breaks down what the UK cyber security jobs market is likely to look like through to 2028 — covering the titles emerging right now, the technologies driving employer demand, the skills that will matter most, and how to position your career ahead of the curve.