Senior Application Security Engineer

About the role

We are looking for a Senior Application Security Engineer to strengthen security across our platforms and Agile Release Trains. You will work closely with product, platform, and cyber‑defense teams to embed secure‑by‑design controls throughout the software development lifecycle.

Key responsibilities

• Advance the application security strategy through multi‑functional initiatives and cultural influence.
• Lead security initiatives across the SDLC and improve development practices through scalable automation.
• Conduct and guide security requirements and threat modeling early in design phases.
• Partner with product management, platform engineering, development and cyber defense teams to align business goals with security needs.
• Lead security architecture, design and code reviews.
• Perform hands‑on security testing to identify risks and drive remediation with development teams.
• Drive software supply chain security practices to protect code, build, and artifact integrity in the CI/CD pipeline.
• Balance business and security risks with pragmatic, technically grounded recommendations.
• Translate lessons learned into reusable assets that enhance the overall security posture.
• Mentor engineers and promote secure‑by‑default thinking and shared accountability.

Required profile

• 5+ years of experience in information security and at least 2 years in software development.
• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience).
• One or more cybersecurity certifications (e.g., CISSP, CEH, CSX, Azure Security Associate, AWS Security Specialty).
• Application security certification (e.g., CASE, CSSLP, OWSA, GIAC CWAD) is a plus.
• Proactive attitude with the ability to lead initiatives independently.

Required skills

• .NET, JavaScript, Python programming languages.
• Deep knowledge of enterprise, cloud, and cloud‑native architectures.
• OWASP Top 10, OWASP SAMM, OWASP DSOMM, OWASP ASVS, MASVS.
• Threat modeling and security requirements definition.
• Security architecture, design, and code review techniques.
• Hands‑on security testing and remediation.
• Software supply chain security and CI/CD pipeline protection.
• Automation of security controls within the SDLC.