Application Security Engineer

About the role

At the heart of everything we do is our vision to change lives every day, and our mission to grow The National Lottery responsibly and champion its impact. We are Allwyn UK, part of the Allwyn Entertainment Group - a multi-national lottery operator with a market-leading presence across the USA (Michigan and Illinois) and Europe, including Czech Republic, Austria, Greece, Cyprus and Italy. While the main contribution of The National Lottery to society is through the funds to good causes, at Allwyn we put our purpose and values at the heart of everything we do. Join us as we embark on a once-in-a-lifetime, largescale transformation journey by creating a National Lottery that delivers more money to good causes. We'll talk a bit more about us further down the page, but for now - let's talk about the role and who we're looking for... A bit about the role The Application Security Engineer is responsible for ensuring the security of software applications through rigorous testing and validation. This role is dedicated to embedding security testing throughout the software development lifecycle (SDLC), identifying vulnerabilities, and supporting development teams in remediating security issues. The focus is on proactive, continuous security assessment of applications, both pre- and post-deployment, to maintain the highest standards of software security. What you'll be doing Collaborate with development teams to create and maintain application threat models (e.g., STRIDE, DREAD). Identify and document application-specific risks; propose effective countermeasures. Integrate and operate application vulnerability scanning tools (e.g., Sonar Cloud, Snyk, OWASP ZAP, Burp Suite, Tenable WAS) within CI/CD pipelines. Interpret vulnerability reports, prioritise remediation based on risk, and track resolution with development teams. Promote awareness of common application vulnerabilities (e.g., SQL injection, XSS, CSRF) and mitigation strategies (OWASP Top 10, ASVS, MASVS). Support development teams in adopting secure coding standards, including static analysis tools, code reviews, and automated linting. Plan, execute, and manage Static, Dynamic, Mobile, and Interactive Application Security Testing (SAST, DAST, MAST, IAST). Embed security testing into CI/CD pipelines for continuous, automated validation. Simulate real-world attack scenarios to identify weaknesses in application logic and implementation. Develop and maintain scripts, tools, and processes to automate application security testing. Produce clear, actionable security testing reports for technical and non-technical stakeholders. Maintain comprehensive documentation of testing methodologies, findings, and remediation guidance. Work closely with software engineers, QA, and product teams to embed security best practices. Deliver training and awareness sessions on application security testing techniques and secure development. What experience we're looking for Must have: 3-5+ years of hands-on experience in application security testing Strong knowledge of SAST, DAST, MAST, and IAST tools and methodologies. Familiarity with secure SDLC and Application DevSecOps practices. Experience integrating application security testing into CI/CD pipelines. Good understanding of common application vulnerabilities and mitigation strategies (OWASP Top 10, ASVS, MASVS). Proficiency in at least one programming or scripting language (e.g., Python, JavaScript, C#). Strong analytical, problem-solving, and troubleshooting skills. Excellent communication and teamwork abilities. Experience in producing clear, concise technical documentation and security reports. Commitment to continuous learning and keeping up with evolving application security threats and technologies. Nice to have: CREST Certified Web Application Tester Bachelor's degree in Software Engineering Key Measures of Success: Proactive identification and remediation of application vulnerabilities. Effective integration of application security testing into development workflows. Demonstrated improvement in application security posture over time. Positive feedback from development teams regarding security testing support. Ability to communicate complex security concepts to technical and non-technical stakeholders About us At Allwyn, we are dedicated to changing lives and growing the National Lottery responsibly, championing its positive impact on people, places, and the planet. Innovation - We pride ourselves on it! We're constantly looking for new ways to excite our customers, bringing new products to market to enjoy which is all supported by our responsible play values and making them accessible to all. Giving back - Did you know that playing the lottery generates around £30m a week for charities and good causes in the UK? Our aim is to have doubled this number by the end of the first 10-year license. Sustainability - Our aim is to become a net zero national lottery. We have 2030 targets to decarbonise our operations and energy. We'

Your Match

How well this role fits your profile.

Company Intel

What employees say

Worked at Allwyn UK? Share your experience