Application Security Engineer (Cloud Security)

Location: Kings Cross, London, United Kingdom

Company

hirify.global is a global music company operating across A&R, finance, legal, digital, sales, and marketing.

What you will do

• Perform application security assessments, threat modeling, secure design reviews, source-code reviews, and manual security validation for internal and third-party applications.
• Conduct SAST, DAST, SCA, API security testing, and penetration-testing activities.
• Partner with engineering, infrastructure, DevOps, product, security, and identity teams to identify risks and implement practical remediation throughout the software development lifecycle.
• Integrate application security testing into CI/CD pipelines and software delivery workflows, including security architecture guidance for APIs, cloud-native services, and technology integrations.
• Support OAuth, OIDC, SAML, and other authentication and authorization technologies; investigate and remediate application-layer incidents and vulnerabilities when required.
• Develop automation, reusable security guidance, reference architectures, documentation, and developer education to improve security-by-design practices.

Requirements

• Bachelor’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
• 5+ years of experience in Application Security, Security Engineering, Software Engineering, or a related security-focused discipline.
• Experience with application security assessments, threat modeling, secure architecture reviews, secure coding principles, OWASP Top 10, and OWASP API Security Top 10.
• Experience with SAST, DAST, SCA, API security testing, and penetration-testing methodologies.
• Experience with REST APIs, microservices, modern application architectures, cloud-native technologies, and at least one of AWS, Azure, or Google Cloud Platform.
• Experience integrating security into CI/CD pipelines and DevSecOps workflows.
• Knowledge of OAuth, OpenID Connect, SAML, JWT, OWASP, the NIST Cybersecurity Framework, and ISO 27001.
• Strong analytical, problem-solving, and communication skills, with the ability to work effectively across technical and non-technical teams.

Nice to have

• Experience implementing SSDLC practices in Agile development environments.
• Experience with GitHub Advanced Security, Microsoft Defender for Cloud, Checkmarx, Veracode, Burp Suite, Semgrep, or similar application security platforms.
• Experience with container security, Kubernetes, Infrastructure as Code security, and security assessments of cloud-native applications and APIs.
• Automation experience using Python, PowerShell, or similar scripting languages.
• CSSLP, GIAC GWEB, AWS Certified Security Specialty, Security+, CISSP, or equivalent certification.
• Experience in large global enterprise environments or in media, entertainment, or similarly distributed global organizations.

Culture & Benefits

• Work within UMG’s global Tech Security & Identity organization and collaborate across security, infrastructure, identity, engineering, DevOps, and product teams.
• Inclusive workplace with reasonable adjustments available throughout recruitment, workplace, and work processes.
• Responsibilities may change and develop as business needs evolve; the job description is indicative rather than exhaustive.