Application Security Engineer

About the role

ABOUT US

At OakNorth, we're on a mission to empower ambitious businesses and the communities they serve. Since 2015, we've lent over $21 billion across the UK and US, helped create more than 58,000 new homes and 36,000 new jobs, and supported hundreds of thousands of personal savers — all while driving economic growth in the markets we serve.

ABOUT THE ROLE

The Application Security Engineer is a hands-on, full-stack security role focused on fixing the hardest application and AI security problems — particularly those that cross team boundaries or involve architecture, authentication, and authorisation that automation cannot yet safely resolve. You'll take remediation load away from engineering teams so they can stay focused on delivery, working closely with the teams that detect, prioritise, and track vulnerabilities. You'll also contribute to the development of OakNorth's internal coding agent platforms, so security fixes can scale safely.

WHAT YOU'LL DO

- Fix complex application security vulnerabilities directly, including architectural weaknesses and issues in legacy technology that automated remediation cannot yet handle safely.

- Lead remediation of problems that cross team and system boundaries, coordinating changes across multiple owners and services and seeing them through to resolution.

- Resolve authentication and authorisation weaknesses, including identity, access control, session and token handling, service-to-service trust and permission models.

- Act as a dedicated delivery vehicle for security remediation, reducing the fix burden on engineering teams so they can focus on product delivery.

- Interpret the output of security tooling (e.g., SAST, DAST, SCA, secrets, container and IaC scanning), validate findings, identify root causes and implement the right fix rather than only triaging.

- Secure agentic and AI-enabled systems, assessing and mitigating risks such as those in the OWASP Top 10 for Agentic Applications, including prompt injection, excessive agent permissions, tool misuse, insecure agent-to-agent communication and unsafe handling of agent outputs.

- Contribute to the development of our internal coding agent platforms, including remediation agents, by supplying specialist fixes, remediation patterns, evaluation cases and feedback on where agents succeed or fail.

- Define and build guardrails for agent-generated and human-written changes (e.g., least-privilege agent access, human approval points, secure defaults, shared libraries, pipeline checks and policy-as-code) so that changes are safe and vulnerabilities do not recur.

- Build and secure GitHub workflows and release pipelines, including GitHub Actions hardening, secrets and token handling, branch protection, dependency and supply chain controls, and security gates in CI/CD.

- Plan and deliver higher-risk changes safely, including testing, peer review, rollout and rollback approaches, in partnership with the teams that own the systems.