SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Genomics is a science-led transatlantic TechBio combining large-scale genetic and health data with proprietary analytics to accelerate drug discovery and advance predictive, preventative healthcare. The company operates two business lines: supercharging drug discovery through an AI-enabled advanced genetic analytics platform, and helping people understand their personal risk of common chronic diseases through polygenic risk scores.
As Senior Application Security Engineer, you will own application security end-to-end across multi-tenant, trillion-row-scale, AI-enabled data platforms. Genomic data is among the most sensitive data in existence, and customers trust the company with it. You will lead threat modelling and design reviews with product teams, build the tooling and patterns that make secure code the default, and find and fix vulnerabilities that slip through. You will use security-focused AI tooling, steered by your own expert judgment and intuition, to keep Genomics secure against state-of-the-art threats.
Key responsibilities include: leading threat modelling and design reviews for new products and infrastructure, defining security invariants every team builds against (tenant isolation, authentication and authorisation, secrets, least privilege, trust boundaries); building libraries, patterns, and CI/CD guardrails that make the secure way the easy way; building and tuning AI tooling for code analysis, triage, and remediation; hunting for vulnerabilities through code review, testing, and proof-of-concept exploits, then running the disclosure programme and driving findings through to verified fixes; securing agentic and AI surfaces (prompt injection, tool boundaries, delegated credentials, tenant-scoped access); and working as an embedded, trusted partner to product teams, SRE, detection and response, the data platform team, and the MystraAI/ML team.
The role is hybrid, based in Oxford or London.
REQUIREMENTS:
- Production-level application security experience: you have found and fixed exploitable bugs in software you were responsible for, through threat modelling, secure design, code review, and proof-of-concept exploitation across web services, APIs, and data-serving interfaces. Scanner triage alone does not qualify.
- Production-quality software engineering in at least one mainstream language (Python, Go, or TypeScript), with ability to read several. You have built and operated security or developer tooling in CI/CD pipelines (static and dependency analysis, secrets detection, policy-as-code), and engineers actually adopted it.
- Hands-on depth securing multi-tenant systems on a major cloud. The company runs on AWS (RDS, EC2, S3, EKS, Batch); comparable GCP or Azure depth transfers. You know tenant isolation, IAM and least privilege, secrets management, Kubernetes and container security, and trust boundaries between services.
- Daily use of frontier AI models for code analysis, vulnerability triage, remediation drafting, and research, with sharp judgment about where they are reliable and where they mislead. You have built or tuned LLM-driven tooling rather than only used a chat interface, and understand the attack surface it introduces.
- Experience running or being core to a vulnerability disclosure or bug bounty programme and the remediation lifecycle (severity, prioritisation, SLAs, root cause, systemic fixes). You have worked application-layer incidents alongside detection and response, using security telemetry and SIEM data as evidence.
- Risk-led judgment: you know which designs need deep review, which findings matter and which are noise, and you make accepted risk explicit so leadership can decide with open eyes.
- Clear communication: you explain risk and trade-offs precisely to engineers, product, and leadership, write guidance people actually use, and mentor others to grow security capability across teams.
