Application Security Lead at Salmon Group

The Role

You'll own application security across our mobile banking platform, payments stack, and a growing set of regulated products. The work is hands-on, you’ll conduct a threat modeling, security reviews, CI/CD tooling - with real process ownership. You'll report to the Group CISO and work closely with both our engineering teams and the Bank IS function.

Responsibilities

Risk-driven security ownership

• Identify which systems, data flows, and product changes carry the highest real-world risk and build your work around that, not around tool coverage or compliance checklists

• Decide when a security gate is worth slowing down a release and when it isn't, own that call, and be able to explain it to engineering and the CISO

• Maintain a risk register for application-layer exposures: what's open, what's accepted, what's being fixed, and why in that order

Secure SDLC

• Figure out where in our delivery process security decisions are actually being made and put controls there

• Run threat modeling for high-stakes product changes before design is locked, not after

• Build a mobile security testing baseline that the team runs themselves

CI/CD and supply chain

• Assess what the current pipeline actually catches versus what it produces as noise, and fix the ratio before adding more scanners

• Own supply chain posture: dependency pinning, SBOM, internal registry, and the response process when a package gets compromised

• Own secrets detection and remediation end-to-end

Regulatory and cross-team work

• Translate application security gaps into language that satisfies BSP examiners without over-engineering the evidence

• Coordinate security input into new product launches across our Group and Bank structure

Requirements

Experience

• 7+ years in application security, with meaningful ownership over both technical work and process

• Has built or substantially improved a secure SDLC in a fast-moving product org

• Has run threat modeling on real product features and influenced design decisions as a result

• Has owned vulnerability management end-to-end: triage, remediation tracking, SLA management, risk acceptance

• Has done hands-on mobile security testing (iOS and/or Android) in a production context, not just UAT

• Understands modern supply chain attack vectors like compromised packages (npm, PyPI), malicious IDE plugins, typosquatting, dependency confusion - and knows how to reduce exposure at the tooling and process level

• Comfortable writing Python or Bash to automate repetitive security work

Technical skills

• SAST, DAST, SCA in CI/CD pipelines: knows how to tune for signal, not just coverage

• API security: authentication flows, token handling, common abuse patterns

• Mobile security: OWASP ASVS/MASVS applied in practice

• Supply chain: SBOM generation and dependency risk management

• Secrets management: detection, remediation, and structural prevention

• Working knowledge of AWS and containers sufficient to understand where application risks extend into infrastructure

Nice to have

• Experience in a regulated environment (financial services or similar)

• Familiarity with PCI-DSS, ISO 27001, or BSP MORB

• Certifications: OSCP, GWEB, GWAPT, CSSLP

Communication

• Strong written English; most day-to-day alignment is async

• Can explain a security issue clearly to an engineer and summarize the same issue for a non-technical stakeholder