Application Security contract jobs: rates and IR35
UK Application Security contract jobs are how clients buy this skill without opening a permanent seat. The work is the security of the software itself: reviews, tooling in the pipeline and the flaws a test would miss. This page is the market around that skill: who hires, what the day rate looks like, how IR35 tends to fall, and the live contracts on IR35 Jobs.
Updated 1 November 20264 min read
What a Application Security contract is
UK Application Security contract jobs are how clients buy this skill without opening a permanent seat. Clients hire for the security of the software itself: reviews, tooling in the pipeline and the flaws a test would miss. The contract is usually three to six months with an extension if the work continues, and the advert should say whether it is outside IR35, inside IR35, or silent. Silent is common, and it is not the same thing as outside.
The title in the advert is often looser than the skill. A role tagged Application Security on this board matched the skill in the title or the spec, which is a better filter than a job board's own category. Open the Application Security board for the current list rather than a recycled write-up.
Who is hiring
Regulated firms, government, and any board that has just had a finding it cannot leave until next year are the clients behind most Application Security adverts. Agencies still post the majority of contract roles in the UK, so the name on the row is often the recruiter, not the end client. The skill and the IR35 line tell you more than the agency brand.
Demand moves with programmes, not with the calendar. A quiet week on Application Security is not a dead market. New contracts are added every hour, and the ones from the last 48 hours are visible to members first because that is when they get filled.
Application Security day rates
Advertised Application Security day rates commonly sit between £500 and £900. That is the headline number, before tax, umbrella margin or the costs of a limited company. Work clusters in London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh. The rate on a specific advert is on the board when the recruiter published one. Where they wrote "competitive" instead, the role is harder to compare and usually not in a hurry to tell you.
A higher inside IR35 rate can be worth less than a lower outside one. Run both numbers before you negotiate, and read the Application Security day rate guide for how to compare them. Benchmarks across skills are on UK contractor day rates.
IR35 on these contracts
Application Security contracts are genuinely mixed. Product companies and smaller clients more often advertise outside IR35. Large programmes, and anything with a body-shop agency in the chain, more often advertise inside. Treat "outside" as a claim to check, not as a promise, and price an inside offer against take-home rather than against the headline.
Application Security outside IR35 jobs collects the point in one place. The live filter is outside IR35 jobs across every skill, and inside IR35 jobs for the other column. We report the status the advert states. We do not decide it, and neither does a keyword.
Where the work is
Application Security contracts turn up most often in London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh. A city on the advert is not always a daily commute. Hybrid is the default pitch, and a role marked remote should say so rather than implying it.
Use the board's location and radius filters once you are a member. Free browsing shows the delayed board. The link through to the original advert, on every Application Security job, is part of membership and the 14-day pass.
Live roles on the board
These Application Security contracts are on the board now. The day rate and IR35 status are public. The link to the original advert is for members.
- Senior AWS DevOps Engineer — South Croydon, Surrey, £600-£725/day Inside
- Security Engineering Consultant — London, £550-£650/day Outside
- Web Security Engineer, Akamai — City of London (EC1), £550-£600/day Inside
- Senior Threat Modelling & Application Security Engineer — London, £450-£500/day Inside
See live Application Security contracts · Membership unlocks apply links and the first 48 hours