Application Security Engineer

Application Security Engineer Overview

Fin is looking for an Application Security Engineer to join its security engineering function in London. The company builds an AI customer agent designed to help businesses deliver fast, accurate, always-on support across service, sales, and ecommerce. The product is powered by Fin’s own AI models and can work alongside Intercom’s help desk as a single system for modern support teams. Fin has been operating since 2011, has grown into one of the fastest-scaling companies in its space, and serves nearly 30,000 businesses worldwide.

The security engineering group plays a central role in protecting both Fin and its customers. Rather than acting only as a review function, the team builds and runs important security services, develops customer-facing security capabilities, and works directly with product and engineering teams to make secure development the default. The team is responsible for critical trust and security systems such as authentication, SAML/SSO, teammate activity logging, malicious URL scanning, and related controls that support enterprise-grade trust. The broader mission is to ensure that security is built into how products are designed, developed, and delivered, while also evolving security practices as Fin’s AI-powered products and customer base continue to grow.

This role sits within an environment that is actively exploring AI-led security approaches. That includes using AI for detection, automating red-team style testing, improving continuous monitoring, and developing new defensive capabilities to keep pace with an evolving threat landscape. The team is looking for someone who is comfortable operating as an engineer first, with the ability to design, build, and run systems that protect the platform and its users.

What you will do

• Take ownership of core security services that are essential to safe customer deployment and administration of Fin.
• Design and improve customer-facing security functionality, including sign-in systems, SAML single sign-on, permissions and access management, audit logging, activity tracking, malicious link scanning, and other enterprise security features.
• Work alongside engineering teams throughout the full software delivery lifecycle to make secure design and implementation part of normal product development.
• Carry out architecture reviews, threat modelling, and security assessments for new features, systems, and technical changes.
• Build internal security tools, automation, and reusable engineering components that help teams develop securely with less friction and greater scale.
• Help define and spread secure development standards, practical guidance, and best practices across the organisation.
• Lead application security efforts across the SDLC, helping teams identify risks early and address them before they become larger issues.
• Take part in a shared on-call rota and lead incident response work, including investigation, containment, and remediation.
• Drive security initiatives from the initial problem statement through design, implementation, and measurable results.
• Partner with teams building AI-powered products to assess new security risks and put mitigations in place.
• Contribute to Fin’s AI-first security strategy, including AI-assisted detection, automated adversarial testing, continuous monitoring, and other emerging defensive methods.
• Support the safe use of AI-assisted software development tools and workflows across engineering.

What the team is looking for

• Experience in application security, product security, or security engineering within a SaaS business.
• Strong software engineering capability, including experience designing, building, and operating production systems.
• Deep knowledge of modern application security threats, secure development practices, and threat modelling.
• Hands-on experience creating, securing, or operating authentication, authorisation, identity, or enterprise security systems.
• Experience performing architecture reviews and security assessments for complex technical environments.
• Practical incident response experience, including leading investigations and remediation efforts.
• Strong programming ability and experience building tools, automation, or developer-facing solutions.
• Comfort using modern AI-assisted development tools to improve productivity and engineering effectiveness.
• Clear communication skills and the ability to collaborate well with engineering teams.
• A pragmatic approach that balances security requirements, customer impact, and delivery speed.
• Desirable experience includes owning authentication, SAML/SSO, identity, or access management systems.
• Additional bonus experience includes securing AI-powered products or understanding the security implications of large language models, agentic systems, retrieval-based architectures, or AI tool integrations.
• Experience building security automation or security platform capabilities at scale is helpful.
• Familiarity with cloud security, infrastructure security, or distributed systems would be an advantage.
• Experience across both large SaaS environments and high-growth companies is also beneficial.
• Candidates must be authorised to work in the country where the role is based; the application form also asks whether you are willing to relocate and whether you can work from the office three days per week.

Rewards and perks

• Competitive salary together with equity in a fast-growing startup.
• Lunch provided every weekday, plus snacks and a fully stocked kitchen.
• Regular compensation reviews to recognise strong performance.
• Unlimited access to Claude Code and other leading AI tools, with an emphasis on experimentation and building.
• Pension scheme with employer contributions matched up to 4%.
• Life assurance, along with comprehensive health and dental insurance for employees and dependants.
• Flexible paid time off.
• Paid maternity leave and six weeks of paternity leave.
• Cycle-to-Work support, including secure bike storage.
• MacBooks as standard, with Windows available for certain roles where required.

Working style and culture

The role follows a hybrid model. Employees are expected to work from the office at least three days each week, while still having flexibility to work from home. Fin says it values in-person collaboration for connection, teamwork, and culture, but aims to preserve flexibility.

Fin also describes itself as having a broadly open and inclusive culture. The company says it avoids taking positions on divisive social or political topics in internal or external communications, while respecting personal views expressed on personal time and personal social platforms. The goal is to keep the workplace focused on shared values and strong execution.

Fin states that it is committed to equal employment opportunity and does not discriminate on the basis of race, colour, religion, creed, national origin, ancestry, sex, gender, age, disability, veteran or military status, genetic information, sexual orientation, gender identity, gender expression, marital status, or any other legally protected characteristic.

How to apply

Applications are submitted through the Greenhouse form on the page. Candidates can use the quick-apply option and are asked to provide contact details, a CV, and optionally a cover letter. The form also requests information such as current location, willingness to relocate, current or most recent employer, prior employment with Fin or Intercom, LinkedIn profile, website, referral source, what excites the applicant about the role, which company value resonates most, whether the applicant can work from the office three days per week, and consent-related data transfer acknowledgements. The form includes a question about work authorisation and notes that Fin sponsors immigration for some roles, encouraging applicants who need sponsorship to still apply.

Degree Requirement: Not Specified

Visa Sponsorship Promising