Senior Application Security Engineer

Role overview

Provide technical leadership and hands-on application security support across products and services. The role works with engineering and product teams to build security into design, development, testing, and response, while shaping practices that can scale across teams.

Responsibilities

- Lead security work across the software development lifecycle, including improvements supported by automation. - Guide threat modeling and define security requirements early in product design. - Partner with developers, architects, and product managers to weigh security needs against business goals. - Lead security architecture and code reviews for distributed systems, and perform hands-on testing. - Work with vulnerability and incident response teams to address risks; turn lessons learned into reusable security guidance. - Mentor practitioners and influence teams to adopt secure-by-default practices.

Requirements

- At least seven years in information security and three years in software development; a relevant degree or equivalent experience. - Strong understanding of enterprise and cloud-native architecture and secure design. - Knowledge of network and web protocols, including TCP/IP, TLS, HTTPS, OAuth 2.0, and OpenID Connect, and common attack patterns. - Experience reviewing code and guiding secure development, with actionable, risk-based recommendations. - Proficiency in multiple programming languages and in addressing common application vulnerabilities such as the OWASP Top 10. - Experience integrating SAST, DAST, and dependency scanning into CI/CD pipelines, plus familiarity with Agile and DevOps practices.

Nice to have

- Hands-on experience securing cloud environments, Kubernetes, service meshes, or CDNs, including configuration and identity management. - Penetration testing experience and the ability to anticipate and simulate real-world attacks. - Strong communication and leadership skills, including the ability to influence technical and non-technical partners.