# Lead Application Security Engineer

[Cais](https://gurify.com/jobs?q=Cais) · London, United Kingdom · Posted 2 months ago

Lead

[Security](https://gurify.com/jobs/security)

[Apply on the original posting → (opens in a new tab)](https://job-boards.greenhouse.io/cais/jobs/8612146002)

## Job description

CAIS is the pioneer in democratizing access to and education about alternative investments for independent financial advisors, empowering them to engage and transact with leading asset managers on a massive scale through a wide variety of alternative investment products and technology solutions. CAIS provides financial advisors with a broad selection of alternative investment strategies, including hedge funds, private equity, private credit, real estate, digital assets, and structured notes. CAIS also delivers industry-leading technology, operational efficiency, and world-class client service throughout the pre-trade, trade, and post-trade experience. CAIS supports over 50,000 advisors who oversee more than $6 trillion in network assets.

Application security sits at the center of how CAIS earns and keeps the trust of the advisors and asset managers who rely on our platform. As our lead for application security, you will own how we protect the applications and services we build and embedding security into the heart of how we design, write, and ship software.

You will define and drive our approach to secure development: setting threat modeling strategy, owning security architecture and secure code reviews, and designing the controls that live inside our SDLC. Just as importantly, you will use automation and AI to scale that work, turning security from a manual checkpoint into something engineers experience as fast, clear, and genuinely useful.

We are looking for a hands-on technical leader who is as comfortable reading production code as setting strategy. You are someone who enjoys partnering with engineers and product owners; you are eager to experiment with new technologies to raise our security bar across the stack, and you are easy to do business with. You see a growing security practice not as a constraint to enforce but as a capability to build, one that helps us ship reliable products, grow as engineers, and have some fun along the way.

### Responsibilities

### Secure Software Development & Architecture

- Own security elements of the software development lifecycle, designing and implementing automated controls within CI/CD, including SAST, DAST, dependency and container security scanning.

- Conduct security architecture and design reviews across product and platform areas, surfacing risk early and providing clear, actionable remediation paths.

- Drive CAIS's threat modeling strategy, establishing it as a repeatable practice across teams rather than a one-off exercise.

### Vulnerability Management & Engineering Partnership

- Triage, validate, and prioritize findings, coordinating remediation through to resolution with clear ownership and follow-through.

- Liaise with key vendors on penetration testing, vulnerability scanning, and threat modeling, translating external findings into prioritized action.

- Partner with engineers and product owners to embed security pragmatically into design, development, and release, supporting teams without becoming a blocker.

- Provide secure coding guidance and clear documentation that helps teams understand risk and apply secure development practices independently.

- Level up CAIS's security capability across the tech stack, experimenting with new tooling, automation, and AI-assisted workflows as the practice grows.

### Required Experience

- Experience in application or product security teams. A software engineering background is

- Ability to read and reason about production code and hold your own with senior engineers, with working knowledge of Java/Kotlin and JavaScript/TypeScript (React).

- Solid AWS security experience, including securing cloud-native, containerized environments (e.g. EKS).

- Hands-on experience with security tooling across the SDLC, such as SAST, DAST, and dependency or container scanning (specific products are not important).

- Demonstrated experience driving threat modeling and leading security architecture and design reviews.

- Proven ability to lead engineering and security teams in adopting AI tools and automated workflows when it comes to security as part of the SDLC .

- A confident, collaborative communicator who partners effectively with engineers and product owners and explains risk clearly to both technical and non-technical audiences.

- A builder's mindset, you are energized by growing an application security practice from an early stage, eager to experiment and collaborative along the way.

CAIS is consistently recognized as a Best Place to Work, and our culture is at the heart of our success. We are committed to fostering an inclusive environment where employees can be their most authentic self and feel inspired and supported to bring their voice forward to drive community, growth, and innovation. We are an equal opportunity employer, and do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. Learn more about our culture, benefits, and people at https://www.caisgroup.com/our-company/careers

We use technology, including AI tools, to support parts of our recruitment process such as application screening, interview scheduling, and candidate communications. These tools are used to improve efficiency and consistency, but they do not replace human judgement. All hiring decisions are made by people, and we are committed to fair and unbiased assessment of every candidate.

**Live in Cais’s hiring system.** Read from the company's own applicant tracking system, not reposted from a job board — so it's a real, open requisition rather than an ad that outlived the role.

We remove it as soon as it disappears at source.

## More jobs like this

- TR [Senior Application Security Engineer](https://gurify.com/job/senior-application-security-engineer-at-tripadvisor-f77e66b457b0) Tripadvisor · London, United Kingdom · 4 weeks ago
- CO [Security Engineer](https://gurify.com/job/security-engineer-at-conduct-354c5d006329) Conduct · London, United Kingdom · last week
- HA [Senior Security Engineer, Detection and Response](https://gurify.com/job/senior-security-engineer-detection-and-response-at-hackerone-45f09130ce13) Hackerone · London · last week
- CC [Cyber Security Engineer I](https://gurify.com/job/cyber-security-engineer-i-at-checkout-com-b3744d8ed0a5) Checkout Com · London · 2 weeks ago
- MO [Senior Developer Experience Security Engineer](https://gurify.com/job/senior-developer-experience-security-engineer-at-motorway-8088847ce3c6) Motorway · London · 3 weeks ago
- CO [Senior Cloud Native Security Engineer](https://gurify.com/job/senior-cloud-native-security-engineer-at-controlplane-1a80f4fea92c) Controlplane · London · 4 days ago

```json
{"@context":"https://schema.org/","@type":"JobPosting","title":"Lead Application Security Engineer","description":"\u003Cp\u003ECAIS is the pioneer in democratizing access to and education about alternative investments for independent financial advisors, empowering them to engage and transact with leading asset managers on a massive scale through a wide variety of alternative investment products and technology solutions. CAIS provides financial advisors with a broad selection of alternative investment strategies, including hedge funds, private equity, private credit, real estate, digital assets, and structured notes. CAIS also delivers industry-leading technology, operational efficiency, and world-class client service throughout the pre-trade, trade, and post-trade experience. CAIS supports over 50,000 advisors who oversee more than $6 trillion in network assets.\u003C/p\u003E\u003Cp\u003EApplication security sits at the center of how CAIS earns and keeps the trust of the advisors and asset managers who rely on our platform. As our lead for application security, you will own how we protect the applications and services we build and embedding security into the heart of how we design, write, and ship software.\u003C/p\u003E\u003Cp\u003EYou will define and drive our approach to secure development: setting threat modeling strategy, owning security architecture and secure code reviews, and designing the controls that live inside our SDLC. Just as importantly, you will use automation and AI to scale that work, turning security from a manual checkpoint into something engineers experience as fast, clear, and genuinely useful.\u003C/p\u003E\u003Cp\u003EWe are looking for a hands-on technical leader who is as comfortable reading production code as setting strategy. You are someone who enjoys partnering with engineers and product owners; you are eager to experiment with new technologies to raise our security bar across the stack, and you are easy to do business with. You see a growing security practice not as a constraint to enforce but as a capability to build, one that helps us ship reliable products, grow as engineers, and have some fun along the way.\u003C/p\u003E\u003Ch3\u003EResponsibilities\u003C/h3\u003E\u003Ch3\u003ESecure Software Development \u0026amp; Architecture\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EOwn security elements of the software development lifecycle, designing and implementing automated controls within CI/CD, including SAST, DAST, dependency and container security scanning.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EConduct security architecture and design reviews across product and platform areas, surfacing risk early and providing clear, actionable remediation paths.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EDrive CAIS\u0026#39;s threat modeling strategy, establishing it as a repeatable practice across teams rather than a one-off exercise.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EVulnerability Management \u0026amp; Engineering Partnership\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003ETriage, validate, and prioritize findings, coordinating remediation through to resolution with clear ownership and follow-through.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ELiaise with key vendors on penetration testing, vulnerability scanning, and threat modeling, translating external findings into prioritized action.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EPartner with engineers and product owners to embed security pragmatically into design, development, and release, supporting teams without becoming a blocker.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EProvide secure coding guidance and clear documentation that helps teams understand risk and apply secure development practices independently.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ELevel up CAIS\u0026#39;s security capability across the tech stack, experimenting with new tooling, automation, and AI-assisted workflows as the practice grows.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003ERequired Experience\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EExperience in application or product security teams. A software engineering background is\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EAbility to read and reason about production code and hold your own with senior engineers, with working knowledge of Java/Kotlin and JavaScript/TypeScript (React).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ESolid AWS security experience, including securing cloud-native, containerized environments (e.g. EKS).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHands-on experience with security tooling across the SDLC, such as SAST, DAST, and dependency or container scanning (specific products are not important).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EDemonstrated experience driving threat modeling and leading security architecture and design reviews.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EProven ability to lead engineering and security teams in adopting AI tools and automated workflows when it comes to security as part of the SDLC .\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EA confident, collaborative communicator who partners effectively with engineers and product owners and explains risk clearly to both technical and non-technical audiences.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EA builder\u0026#39;s mindset, you are energized by growing an application security practice from an early stage, eager to experiment and collaborative along the way.\u003C/li\u003E\u003C/ul\u003E\u003Cp\u003ECAIS is consistently recognized as a Best Place to Work, and our culture is at the heart of our success. We are committed to fostering an inclusive environment where employees can be their most authentic self and feel inspired and supported to bring their voice forward to drive community, growth, and innovation. We are an equal opportunity employer, and do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. Learn more about our culture, benefits, and people at https://www.caisgroup.com/our-company/careers\u003C/p\u003E\u003Cp\u003EWe use technology, including AI tools, to support parts of our recruitment process such as application screening, interview scheduling, and candidate communications. These tools are used to improve efficiency and consistency, but they do not replace human judgement. All hiring decisions are made by people, and we are committed to fair and unbiased assessment of every candidate.\u003C/p\u003E","identifier":{"@type":"PropertyValue","name":"Gurify","value":"lead-application-security-engineer-at-cais-2e04484adf2f"},"url":"https://gurify.com/job/lead-application-security-engineer-at-cais-2e04484adf2f","datePosted":"2026-07-20","validThrough":"2026-11-02T23:59:59Z","hiringOrganization":{"@type":"Organization","name":"Cais","sameAs":"https://job-boards.greenhouse.io/cais"},"directApply":false,"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressCountry":"GB","addressLocality":"London"}}}
```

```json
{"@context":"https://schema.org/","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Jobs","item":"https://gurify.com/jobs"},{"@type":"ListItem","position":2,"name":"United Kingdom","item":"https://gurify.com/jobs/united-kingdom"},{"@type":"ListItem","position":3,"name":"Lead Application Security Engineer","item":"https://gurify.com/job/lead-application-security-engineer-at-cais-2e04484adf2f"}]}
```