Senior Application Security Engineer

Role overview Help protect a web application and its supporting infrastructure by building security into product development, managing vulnerabilities, and guiding engineering teams on secure practices. The role combines hands-on technical review and incident response with security assessments, compliance work, and developer education. You’ll work closely with product, engineering, and infrastructure colleagues as part of a small technical security team.

Responsibilities - Partner with product teams to incorporate security considerations from feature design through release. - Review application code, dependencies, infrastructure, and configuration, and assess code changes from a secure development perspective. - Identify vulnerabilities, recommend fixes, and improve CI/CD security. - Work with DevOps to secure cloud infrastructure and its Kubernetes environment. - Coordinate security assessments, including code reviews, penetration tests, and bug bounty findings. - Investigate security incidents, examine logs, contain attacks, and recommend measures to reduce recurrence. - Support development-related ISO 27001 controls through audits, project monitoring, training, and vulnerability and patch management practices. - Create secure development materials, run training, and encourage participation in a Security Champions program.

Requirements - Application security experience covering code, dependencies, infrastructure, and configuration. - Ability to conduct secure code reviews and identify practical remediation steps. - Experience with vulnerability assessment and incident investigation. - Familiarity with cloud infrastructure and Kubernetes security. - Ability to work with developers and product teams to embed security in delivery workflows and communicate practices clearly. - Knowledge of development security controls relevant to ISO 27001 compliance.

Nice to have Experience with Ruby on Rails and React applications, AWS EKS, CI/CD security, penetration testing, or bug bounty programs would be relevant to the systems and activities described.