Lead Application Security Engineer

As a Lead Application Security Engineer at Bupa, you'll help protect technology supporting millions of customers and colleagues across Bupa Global, India, and UK.

This is an opportunity to shape how security is built into products from the beginning, creating secure-by-design solutions that support healthcare services people rely on daily.

Working closely with engineering, product, security, and technology teams, you'll lead the development of application security capabilities across development environments.

Key Responsibilities

• Lead the design, implementation, and ongoing improvement of application security tooling and capabilities.
• Provide technical leadership for secure development technologies including Software Composition Analysis (SCA), Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), container security, code signing, and secret detection.
• Integrate security tooling into CI/CD pipelines and development workflows.
• Help development teams embed secure-by-design principles throughout the software development lifecycle.
• Act as the technical lead for application security, supporting engineers and stakeholders across the organisation.
• Build and develop a high-performing team of application security engineers through coaching, mentoring, and knowledge sharing.
• Drive automation through scripting, APIs, and infrastructure-as-code practices.
• Monitor and support application security platforms, providing expert troubleshooting and incident support.
• Ensure security controls align with industry standards and regulatory requirements including ISO 27001, NIST, and GDPR.
• Develop performance metrics and reporting that help measure and improve application security outcomes.
• Work with technology, compliance, and business teams to strengthen security awareness and ownership across Bupa.

What We're Looking For

• Significant experience designing, implementing, and managing application security programmes and tooling.
• Strong knowledge of application security practices, secure coding principles, and vulnerability management.
• Experience working with SCA, SAST, DAST, and related application security technologies.
• Strong experience integrating security into CI/CD pipelines and DevSecOps environments.
• Experience with automation and scripting tools such as Terraform, PowerShell, Python, and REST APIs.
• Experience leading technical teams and developing high-performing engineers.
• Knowledge of security frameworks and regulations including ISO 27001, NIST, and GDPR.
• Excellent communication skills, with the ability to explain technical concepts clearly to different audiences.
• Degree-level qualification in Cyber Security, Information Technology, or a related discipline, or equivalent practical experience.
• Professional certifications such as CISSP, CISM, and/or CISA would be advantageous.
• Experience operating within complex enterprise environments.

Benefits

• 25 days holiday, increasing through length of service, with option to buy or sell
• Enhanced pension and life insurance
• Private medical insurance
• Access to health and wellbeing services
• Discounts on Bupa products and services