Senior Application Security Engineer

Senior Application Security Engineer

Department: Engineering

Employment Type: Permanent - Full Time

Location: London

Reporting To: Sami Eltamawy

Compensation: £80,000 - £90,000 / year

Description

London, office-based

Freetrade’s mission is to become the default place to invest. Investing has been too complicated and expensive for too long, keeping millions from making the most of their savings.
We’re changing that.
We’re building our team and looking for people who are excited to reshape how our customers invest and grow their wealth. If you’re driven by solving complex problems and building innovative products, you’ll fit right in.
2025 is a big year for us. In January, we announced a game changing deal to become part of the IG Group. We’ll continue to operate as an independent business while gaining access to the resources and support of an established leader in the space.
This year, we’re accelerating our roadmap and taking our products to the next level. We’re building new features like mutual funds, bonds, and family investment tools. We’re also exploring how we can leverage AI to deliver an even better experience for our customers.
As a Senior Security Engineer, you’ll lead the charge in building and scaling our Application Security (AppSec) program from the ground up. Your mission will be to embed security into every phase of our development lifecycle, ensuring our products are not only innovative but resilient against threats.You’ll be working across a rich and diverse attack surface, including our web, Android, and iOS applications, as well as the backend systems that power them. This is a rare opportunity to shape the security landscape of multiple platforms at once and have a tangible impact on the safety and trust of our entire product ecosystem.

If you're ready to take on a critical role in shaping the future of our security landscape, we want to hear from you. Join us in our mission to build secure, reliable products and protect the digital experiences of our users.

Key Responsibilities

• Build and Own the AppSec Program: Define and implement policies, processes, and tools to protect our applications from inception through deployment.
• Conduct Security Architecture Reviews: Evaluate system designs and identify risks early by recommending secure alternatives for architectural decisions. Ensure architectural security across mobile (Android and iOS), web, and backend systems.
• Code and Design Reviews: Review critical code changes for security flaws and promote best-in-class secure coding standards. Perform code reviews across front-end, mobile, and backend services.
• Lead Penetration Testing Efforts: Perform in-depth black-box, grey-box, and white-box testing to detect and eliminate vulnerabilities. Test all user-facing surfaces (web, Android, iOS) and backend APIs for security weaknesses.
• Manage SAST and DAST Findings: Drive effective triage and resolution of security test results, improving signal-to-noise ratios.
• Perform Threat Modelling: Use frameworks like STRIDE to proactively uncover potential threats and define mitigations. Model threats across full-stack flows, including cross-platform interactions between mobile apps, web clients, and backend systems.
• Collaborate Across Teams: Work closely with engineers, product managers, and platform teams to prioritise and remediate vulnerabilities.
• Secure the Development Lifecycle: Integrate security controls and requirements into product roadmaps from the very beginning.
• Mentor and Lead: Act as a mentor to future hires, helping scale a high-impact cloud security function as the business grows.
• Promote Security Awareness: Educate developers on secure coding practices and help cultivate a security-first culture across the organisation.

What you'll bring

• Experience: 5+ years of experience in application security, with a proven track record of identifying and remediating vulnerabilities
• Expertise: Strong understanding of secure coding practices, including OWASP Top 10 and SANS 25 Most Critical Software Errors
• Automated Testing: Experience with static and dynamic application security testing tools
• Penetration Testing: Proficiency in penetration testing methodologies, including black-box, gray-box, and white-box testing
• Threat Modeling: Familiarity with threat modeling techniques such as STRIDE and PASTA
• Tech Stack: Experience with TypeScript, Node.js, Kotlin, Java, Swift, and React.
• Education: Bachelor's degree in Computer Science, Information Security, or a related field

Key Attributes for Success

• Leadership: Inspire and guide teams toward secure outcomes.
• Initiative & Autonomy: Self-driven and proactive, with the ability to lead initiatives independently.
• Adaptability: Comfortable navigating ambiguity and evolving technical landscapes.
• Influence: Skilled at driving security priorities without direct authority.
• Resilience: Perseveres through complex challenges with focus and determination.
• Collaboration: Brings cross-functional teams together around shared security goals.
• Problem-Solving: Brings creativity and innovation to solving security issues.

Benefits & Logistics

Freetrade is the place to accelerate your career. Our benefits package and ways of working are designed to attract and retain the most talented people who are dedicated to making an impact at Freetrade.  

Here’s what’s on offer in 2025:

Office first culture - we have beautiful office spaces in central London and Budapest where four days a week you collaborate with colleagues in person, one of our core behaviours is that we’re a team that works better together. 
Values - at Freetrade we live and breathe our values: Honesty, Focus and Grit. Expect to be asked about these in your interview! 
Benefits In London: 

• Competitive salary – carefully benchmarked.
• Holidays – 25 days plus UK public holidays. Your birthday off, plus one extra day for every year at Freetrade.
• Enhanced pension – We’ll match your contributions up to 5%.
• Group Life Insurance – Protect your loved ones with coverage at 5x your salary, ensuring financial security in any circumstance. 
• Private Health Insurance - Which includes access to high quality medical care, mental health support, dental and vision plans, Wellness programs and preventative care initiatives are also provided to ensure the wellbeing of your entire family.
• Income Protection Cover – Safeguard your income with comprehensive coverage, ensuring financial stability in the event of illness or injury.
• Enhanced parental leave – Time off when it matters most.
• Flexibility for those who need it – We’re office-first, but life happens. Whether you’re a parent or have care responsibilities, we focus on output and trust you to manage your time.
• Learning & Development – We fund industry qualifications so you can grow as a financial services professional. 
• Cycle to Work scheme – Get a high quality bike and gear through our salary sacrifice scheme, spreading the cost with tax free monthly installments.
• Paid Sick Leave – Receive 10 days of fully paid sick leave each calendar year.

Following the completion of our acquisition by IG Group, you can expect our benefits package to further improve as we align with the broader offerings available across the group.

Interview Process
We keep things simple and transparent. Our process typically includes:

1.  Initial Screening – A quick chat with one of our Talent Partners.
2.  Hiring Manager interview – A deep dive into your skills and experience.
3.  Technical interview – Show us how you think and solve problems.
4.  Executive interview – A conversation with our stakeholders, where we also assess cultural fit.

We are an Equal Opportunity employer committed to a diverse and representative team. Whatever your race, religion, colour, national origin, gender, sexual orientation, age, marital status, or disability - we want to hear from you. We're very open about what we're working on, and the best places to learn more are our buzzing community forum and our blog.
To find out more about how we look after your personal data when you apply for a job with us, please see our Recruitment Privacy Policy here.
Please note we are not accepting agency CVs.