# Lead Security Engineer (Application Security)

[Encord](https://gurify.com/jobs?q=Encord) · London · Posted yesterday

Lead

[Security](https://gurify.com/jobs/security)

[Apply on the original posting → (opens in a new tab)](https://jobs.ashbyhq.com/encord/275cbc61-2834-4040-8bcd-ce885c55d4f6)

## Job description

### ABOUT US

Encord is the universal data layer for AI that helps 300+ AI teams train and run models on the right data. Our platform indexes, curates, annotates, and evaluates data across the full AI lifecycle, from development through production.

Trusted by Woven by Toyota, AXA, UiPath, Zipline, and more. We're an ambitious team of 100+ working at the frontier of AI and have raised $60M in Series C funding from Wellington Management, CRV, Next47 and Y Combinator.

### About the role

As Lead Security Engineer, you'll own application security across our platform, embedding secure practices into how we design, build, and ship software, and setting the direction for a growing security function.

### What you'll do

- Own the application security program end to end: threat modelling, secure design reviews, code review, and vulnerability management.

- Build security into the SDLC with SAST, DAST, dependency/SCA, and secrets scanning integrated into CI/CD without slowing teams down.

- Partner with engineering on authentication, authorization, multi-tenancy isolation, and data protection across our APIs and SDKs.

- Lead penetration testing, bug bounty triage, and incident response for application-layer issues.

- Support customer security reviews and compliance (SOC 2, HIPAA, GDPR) with practical technical controls.

- Mentor engineers and raise the security bar across the organisation.

### What we're looking for

- 7+ years in software or security engineering, with significant hands-on AppSec experience.

- Strong coding ability (Python and/or TypeScript ideal) and the credibility to review and fix code, not just flag issues.

- Deep knowledge of web and API security (OWASP Top 10, OAuth/OIDC, authz models, SSRF, injection, deserialisation).

- Experience securing cloud-native SaaS (GCP or AWS, Kubernetes, containers).

- Track record of building security tooling and processes in a fast-moving product company.

- Clear communicator who can influence engineering teams and speak to enterprise customers.

### Nice to have

- Experience with ML/AI systems security (data pipelines, model supply chain, LLM-specific risks such as prompt injection).

- Background in regulated industries such as healthcare.

- Previous experience as an early or first dedicated security hire.

### Why Encord

- Competitive salary, and meaningful equity in a high-growth startup

- Strong in-person culture — most of the team works from our London office 4+ days/week

- 25 days annual leave + UK public holidays

- Annual learning & development budget

- Travel for customer visits, events, and conferences across the UK and Europe

- Daily company lunches

- Monthly socials & bi-annual team offsites

### OPERATING PRINCIPLES

### HIGH AGENCY

You see something broken, you fix it or find the person who can. We celebrate the people who solve 90% of a problem before anyone asks.

### Build with care & urgency

We bear-hug the customer. Former founders and people from fast-moving, high-stakes environments thrive here.

### Self-aware & hungry

We stay warm, self-aware, and genuinely hungry. We elevate our peers, and ego doesn't last long.

### Invent in real time

We move toward the ambiguity. We’re pragmatic, resourceful, energized by the fact that there's no playbook.

If you're looking to do the most meaningful work of your career alongside people who push you to be better, we'd love to meet you.

**Live in Encord’s hiring system.** Read from the company's own applicant tracking system, not reposted from a job board — so it's a real, open requisition rather than an ad that outlived the role.

We remove it as soon as it disappears at source.

## More jobs like this

- EN [Lead Cloud Security Engineer](https://gurify.com/job/lead-cloud-security-engineer-at-encord-fdddf261550a) Encord · London · yesterday
- WR [Security engineer, application security (UK)](https://gurify.com/job/security-engineer-application-security-uk-at-writer-3e2e8f916112) Writer · London, United Kingdom · last week
- BJ [Application Security Engineer AppSec](https://gurify.com/job/application-security-engineer-appsec-at-bjak-8f3fb2b73b03) Bjak · United Kingdom · 3 weeks ago
- BJ [Application Security Engineer AppSec](https://gurify.com/job/application-security-engineer-appsec-at-bjak-f9ac95b0955d) Bjak · United Kingdom · 4 weeks ago
- ST [Principal Product Security Engineer](https://gurify.com/job/principal-product-security-engineer-at-storiogroup-6e70bdbb5855) Storiogroup · London, United Kingdom · last week
- OL [Security Engineer](https://gurify.com/job/security-engineer-at-olix-9a4e268c9deb) Olix · London, United Kingdom · last week

```json
{"@context":"https://schema.org/","@type":"JobPosting","title":"Lead Security Engineer (Application Security)","description":"\u003Ch3\u003EABOUT US\u003C/h3\u003E\u003Cp\u003EEncord is the universal data layer for AI that helps 300\u002B AI teams train and run models on the right data. Our platform indexes, curates, annotates, and evaluates data across the full AI lifecycle, from development through production.\u003C/p\u003E\u003Cp\u003ETrusted by Woven by Toyota, AXA, UiPath, Zipline, and more. We\u0026#39;re an ambitious team of 100\u002B working at the frontier of AI and have raised $60M in Series C funding from Wellington Management, CRV, Next47 and Y Combinator.\u003C/p\u003E\u003Ch3\u003EAbout the role\u003C/h3\u003E\u003Cp\u003EAs Lead Security Engineer, you\u0026#39;ll own application security across our platform, embedding secure practices into how we design, build, and ship software, and setting the direction for a growing security function.\u003C/p\u003E\u003Ch3\u003EWhat you\u0026#39;ll do\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EOwn the application security program end to end: threat modelling, secure design reviews, code review, and vulnerability management.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EBuild security into the SDLC with SAST, DAST, dependency/SCA, and secrets scanning integrated into CI/CD without slowing teams down.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EPartner with engineering on authentication, authorization, multi-tenancy isolation, and data protection across our APIs and SDKs.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ELead penetration testing, bug bounty triage, and incident response for application-layer issues.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ESupport customer security reviews and compliance (SOC 2, HIPAA, GDPR) with practical technical controls.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EMentor engineers and raise the security bar across the organisation.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EWhat we\u0026#39;re looking for\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003E7\u002B years in software or security engineering, with significant hands-on AppSec experience.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EStrong coding ability (Python and/or TypeScript ideal) and the credibility to review and fix code, not just flag issues.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EDeep knowledge of web and API security (OWASP Top 10, OAuth/OIDC, authz models, SSRF, injection, deserialisation).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience securing cloud-native SaaS (GCP or AWS, Kubernetes, containers).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ETrack record of building security tooling and processes in a fast-moving product company.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EClear communicator who can influence engineering teams and speak to enterprise customers.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003ENice to have\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EExperience with ML/AI systems security (data pipelines, model supply chain, LLM-specific risks such as prompt injection).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EBackground in regulated industries such as healthcare.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EPrevious experience as an early or first dedicated security hire.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EWhy Encord\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003ECompetitive salary, and meaningful equity in a high-growth startup\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EStrong in-person culture \u2014 most of the team works from our London office 4\u002B days/week\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003E25 days annual leave \u002B UK public holidays\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EAnnual learning \u0026amp; development budget\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ETravel for customer visits, events, and conferences across the UK and Europe\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EDaily company lunches\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EMonthly socials \u0026amp; bi-annual team offsites\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EOPERATING PRINCIPLES\u003C/h3\u003E\u003Ch3\u003EHIGH AGENCY\u003C/h3\u003E\u003Cp\u003EYou see something broken, you fix it or find the person who can. We celebrate the people who solve 90% of a problem before anyone asks.\u003C/p\u003E\u003Ch3\u003EBuild with care \u0026amp; urgency\u003C/h3\u003E\u003Cp\u003EWe bear-hug the customer. Former founders and people from fast-moving, high-stakes environments thrive here.\u003C/p\u003E\u003Ch3\u003ESelf-aware \u0026amp; hungry\u003C/h3\u003E\u003Cp\u003EWe stay warm, self-aware, and genuinely hungry. We elevate our peers, and ego doesn\u0026#39;t last long.\u003C/p\u003E\u003Ch3\u003EInvent in real time\u003C/h3\u003E\u003Cp\u003EWe move toward the ambiguity. We\u2019re pragmatic, resourceful, energized by the fact that there\u0026#39;s no playbook.\u003C/p\u003E\u003Cp\u003EIf you\u0026#39;re looking to do the most meaningful work of your career alongside people who push you to be better, we\u0026#39;d love to meet you.\u003C/p\u003E","identifier":{"@type":"PropertyValue","name":"Gurify","value":"lead-security-engineer-application-security-at-encord-982286c0b753"},"url":"https://gurify.com/job/lead-security-engineer-application-security-at-encord-982286c0b753","datePosted":"2026-11-12","validThrough":"2026-12-28T23:59:59Z","hiringOrganization":{"@type":"Organization","name":"Encord","sameAs":"https://jobs.ashbyhq.com/encord"},"directApply":false,"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressCountry":"GB","addressLocality":"London"}}}
```

```json
{"@context":"https://schema.org/","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Jobs","item":"https://gurify.com/jobs"},{"@type":"ListItem","position":2,"name":"United Kingdom","item":"https://gurify.com/jobs/united-kingdom"},{"@type":"ListItem","position":3,"name":"Lead Security Engineer (Application Security)","item":"https://gurify.com/job/lead-security-engineer-application-security-at-encord-982286c0b753"}]}
```