Application Security Consultant

Overview

We are seeking a versatile and proactive Application Security Consultant to join Handelsbanken UK, which is currently undergoing a major technology transformation programme. We are modernising our tech stack whilst preserving trust and security. You will act as the security lead in an application development delivery team working across a complex hybrid tech stack including Java/React, J2EE microservices, RPG/JSP hosted on z/OS and an API driven architecture.

A key focus of this role will involve uplifting our application development security processes to enable the team to deliver quickly and securely. You will operate our existing secure change process whilst helping revise and uplift the application development security assurance operating model. Your work will cover metrics, templates, controls, automation, secure code practices and workflows.

The Bank operates a model where information security consultants are embedded into work streams acting as the security lead for that delivery team. This is not a traditional advisory role - you will be actively participating in solving information security problems, working closely with engineers, product managers, and business stakeholders to identify, assess, and collaboratively solve security challenges and ensure the team can continue to deliver at pace.

This is a unique opportunity to work on an exciting technology change programme, influencing the security posture of critical Bank systems while collaborating closely with engineers, product managers, and business stakeholders. You ll often operate independently of other security and privacy subject matter experts, so a broad and deep understanding of security and privacy domains is essential - from secure architecture and threat modelling to data protection and regulatory compliance.

If you thrive on autonomy, love solving complex problems, and want to see the real-world impact of your work in a critical industry - this is the role for you.

• Risk and Control Assessments - You will lead risk & control assessments using the Banks defined processes, covering supplier due diligence, privacy impact assessments and project security.
• Risk Management - You will support your workstream to identify and articulate risks, steer them towards appropriate treatment plans, document mitigating controls and ensure these are actions within agreed time frames.
• You will operate in line with the Bank s Risk Management framework (including sub-frameworks) and relevant risk and compliance policies and procedures, ensuring appropriate and timely escalation of any concerns to your line manager.
• Advisory - You will provide specialist advice and interpretation of Information Security best practice and UK regulatory requirements to a range of different stakeholders as new products, processes and systems are developed.
• You will need to be aware of your own knowledge gaps and when & where to seek specialist input to solve a particular problem or query
• Subject Matter Expertise - You will develop a deep knowledge of the Bank s secure change processes and procedures, shepherding your workstream through various assessments and approval gates
• Relationship Management - You will build deep, trust based relationships with key stakeholders within your delivery team such as developers, testers, product managers, delivery leads and tech leads.
• You will be an active member of the delivery team, attending daily stand-ups, PI planning sessions and working groups.

Research (by Harvard University) shows that women are particularly likely to second guess themselves and not apply - so if you are worried you don t meet all the criteria, get in touch anyhow and let us do the worrying...

• You have a blend of technical skills (secure coding, threat modelling, SAST/DAST tooling etc) and SDLC experience with a focus on securing software throughout the lifecycle
• You are a skilled communicator, able to convey complex security issues to a wide audience, including non-technical colleagues.
• You have a pragmatic, delivery-focused mindset and are comfortable owning outcomes and taking accountability.
• You love building strong…