Contract Application Security Specialist - Outside Ir35

We're supporting a global engineering organisation looking for a Contract Application Security Specialist to help embed secure development practices across their software and related hardware products. This is a long-term programme of work, offered on an initial six-month contract with likely six-month renewals. The role is outside IR35. Role Overview: You'll work closely with engineers and leadership to drive secure SDLC, lead threat modelling, assess vulnerabilities, and support alignment with the EU Cyber Resilience Act. Experience Required:

• Strong hands-on experience with Application Security tooling, particularly SCA and SAST
• Strong understanding of secure software development practices
• Deep hands-on experience with threat modelling
• Strong understanding of secure coding principles and OWASP
• Ability to engage with software teams and speak their language
• Relevant backgrounds may include AppSec, Product Security, Ethical Hacking / Offensive Security, DevSecOps, Secure SDLC or Penetration Testing
• Experience with electronics, hardware or robotics would be useful but is not essential Location: Remote with occasional travel to Gloucestershire office - Once or twice per month Contract: Outside IR35; initial six months with likely six-month renewals