Remote job
Senior Security Engineer - AppSec (d/f/m)
Job details
About this role
Role overview
Build and lead an application security program for a high-traffic, API-driven software platform. The role spans product and cloud security, combining hands-on testing with architecture guidance, vulnerability management, and practical changes to how engineering teams design and ship software.
Responsibilities - Establish and evolve the application security program, including risk-based vulnerability management and security practices integrated into development. - Assess web applications, APIs, and business logic through threat modeling, penetration testing, and red-team-style exercises. - Improve security across application and platform layers, including cloud infrastructure, Kubernetes workloads, and deployment pipelines. - Partner with engineers to prioritize findings, explain risks, and support effective remediation. - Develop scripts or tools that automate security work and, where useful, evidence collection. - Help strengthen CI/CD controls and make security feedback useful earlier in the software lifecycle.
Requirements - At least five years of security engineering experience, ideally in a SaaS, e-commerce, or fintech environment. - Strong understanding of web and API vulnerabilities, application business logic, and secure cloud workloads. - Experience independently taking security initiatives from planning through delivery. - Proficiency in at least one programming language for scripting or security automation. - Bachelor’s or master’s degree in a relevant technical field, or equivalent practical experience.
Nice to have - Experience with PCI DSS script security, red or purple team work, or advanced penetration testing. - Familiarity with Terraform and infrastructure-as-code security testing. - Experience with Kubernetes and a major cloud provider; exposure to Go or TypeScript is useful.
Benefits and work setup - Work across a multi-tenant, multi-region cloud environment with Kubernetes and GitOps-based deployment practices. - Collaborate with a distributed engineering organization and help shape security culture and tooling.