Senior Application Security Engineer

Responsibilities: Security Architecture & Threat Modelling:

• Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams

• Act as a security force multiplier by influencing the standards, patterns, and guardrails that let teams move fast and stay secure

Security Automation & Tooling:

• Design, build, and automate scalable security processes that engineering teams can self-serve, covering secure design review, threat modelling, testing, and remediation workflows

• Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning), tuned for strong signal and low friction

• Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms, maximising automation, coverage, and integration

• Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define how the team adopts these tools safely

Security Testing & Vulnerability Management:

• Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development

• Run vulnerability scans across internal infrastructure and the external perimeter, then analyse findings, define remediation, and track issues to closure

• Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible

• Participate in and help lead red teaming and offensive security exercises

Enablement:

• Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams

Requirements: Experience:

• 5+ years in application or product security, or equivalent depth, with a track record of senior or staff-level impact

• Demonstrable experience leading security architecture reviews and threat modelling (e.g. STRIDE, attack trees, data-flow analysis) across multiple teams or products

• Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort

Technical:

• Strong hands-on security testing skills, including code review and web, mobile, and API application security assessments, as well as the ability to triage and validate external vulnerability reports and bug bounty submissions

• Strong software engineering ability in at least one language (e.g. Python, Go, JavaScript), with the ability to build automation, not just scripts

• Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices

• Experience with SAST, DAST, SCA, and vulnerability management platforms, and integrating them into CI/CD

• Strong understanding of modern application architectures: REST APIs, microservices, cloud-based systems, and containers

• Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so

Collaboration:

• Excellent communication and influencing skills: you can explain security concepts to technical and non-technical stakeholders and drive change without direct authority

• A self-starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture

Nice to have:

• Experience securing the AI harness: hardening LLM and agent pipelines, prompts, tool and MCP integrations, and model endpoints against prompt injection, data leakage, and insecure agent actions

• Experience securing Kubernetes, including cluster hardening, RBAC, network policies, admission control, workload isolation, and image and supply-chain security

• Experience securing AWS infrastructure, including IAM, network and account architecture, key and secret management, and CSPM

• Experience building AI-assisted security tooling or internal self-service security platforms

• Experience mentoring or technically leading a security team

• Offensive or advanced security certifications such as OSAI, OSEP, OSCP, or OSWE

What you'll get in return: • You will join the company, that cares about work and life balance

• Annual Bonus based on the performance review cycle

• Generous Annual Leave Policy

• Medical Insurance and Pension fund, with additional benefit packages based on the location

• Hybrid working model (3 days from our modern office and 2 days fully remotely)

• Comprehensive Workation Policy with 30 more remote days available.

• Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.