search Browse Jobs
Application Security EngineerCentrica · 2 Locations
Centrica logo

Centrica

company page ↗

Application Security Engineer

🗓️ Posted 2026-10-13 2 Locations Hybrid ICT
💰 Salary Not shared 📊 Market 3,500 GBP–5,200 GBP/mo

About the Company

Centrica is an international energy services and solutions company, founded on a 200-year heritage of serving customers in homes and businesses. We supply energy and services to over 10 million customers, mainly in the UK and Ireland, through brands such as British Gas, Bord Gáis Energy and Centrica Business Solutions. Through our trusted brands, we deliver innovative energy and services solutions to help solve customers' needs, supported by thousands of engineers and technicians. We are committed to energising a greener, fairer future. Utilities Specialties: Energy Services & Technology, Energy Retail, Connected Home, Distributed Energy, Home Services, Renewable energy, energy trading, Energy Storage

Responsibilities

  • ● An opportunity to play your part - Are you passionate about building security into the heart of modern software delivery We're looking for an experienced Application Security Engineer to help strengthen secure development practices across Centrica's multi-cloud environment, with a key focus on AWS, Azure DevOps and modern DevSecOps tooling. This is a brilliant opportunity to work closely with engineering, platform and security teams to reduce risk, improve our security posture and make secure, automated and scalable delivery feel like second nature. You'll help define and embed application standards, champion developer enablement and play an important role in shaping Centrica's wider security capability. If you love the idea of helping teams move fast without leaving security behind, this role gives you the chance to bring your expertise, curiosity and practical problem-solving to work that really matters.
  • ● Day to day -
  • ● Collaborate with DevOps and engineering teams to weave security best practice into the software development lifecycle, helping teams deliver at pace without compromising on protection.
  • ● Provide practical guidance on secure design, implementation and architecture, including API security, microservices patterns and cloud-native application security.
  • ● Carry out ongoing manual security assessments, coordinate third-party engagements where needed, and turn findings into clear, prioritised actions.
  • ● Review SAST, DAST and SCA outputs, driving remediation through to closure and keeping tracking, ownership and prioritisation firmly on course.
  • ● Provide on-demand application security support while driving continuous improvement across processes, tooling and ways of working, making security simpler, smarter and more scalable.
  • ● Lead or contribute to the Security Champions programme and work closely with GSOC and CSIRT teams on application-layer security incidents, helping build a strong, distributed security culture across engineering.
  • ● What you would bring -
  • ● Strong hands-on experience in application security, with a solid understanding of secure software development, OWASP Top 10, common application vulnerabilities and secure SDLC practices.
  • ● Proficiency in one or more programming languages, such as Python or JavaScript, with experience using code to support security automation, tooling, custom rule development or other clever ways to make security scale.
  • ● A strong working knowledge of DevOps pipelines, repositories and CI/CD security integration, including platforms such as Azure DevOps and GitHub Actions, with the confidence to bring security into delivery without slowing everyone down.
  • ● Practical experience with security tooling and practices including SAST, DAST, SCA, container scanning, vulnerability management, SBOM tooling such as CycloneDX, IaC security across Terraform, Bicep, Ansible and tools such as Trivy, plus Policy as Code and threat modelling.
  • ● A proactive, curious and collaborative approach, with the ability to guide engineering teams, support third-party supply chain security and make complex topics feel practical; desirable extras include certifications such as GWAPT, GWEB, OSCP or AWS Security Specialty, Security Champions or developer training experience, and exposure to SOC or Incident Response environments.
  • ● What's in it for you
  • ● Enjoy a generous market salary, along with fantastic growth opportunities and a vibrant work environment
  • ● Power up your pay with a 15% Employee Energy Allowance, surpassing the government's price cap