Senior Application Security Engineer

Responsibilities

• Conduct web and mobile application security assessments and API security testing
• Perform threat modelling, secure code reviews, and attack surface analysis
• Support SAST and DAST initiatives
• Assist in managing the vulnerability lifecycle
• Coordinate internal and external security assessments, ensuring proper scoping and timely delivery
• Track and report on remediation progress
• Ensure secure coding practices are followed
• Collaborate with developers, testers, and business analysts to provide proactive security guidance during development sprints
• Contribute to security frameworks, checklists, and guidelines (aligned with OWASP, NIST, MITRE)
• Work on DevSecOps testing and protective controls
• Assist in the investigation and resolution of application security incidents
• Contribute to post-incident analysis and implement preventative measures
• Stay informed about cybersecurity trends, emerging threats, and attack vectors
• Research and contribute to the implementation of innovative security solutions
• Identify process improvements to enhance the efficiency and effectiveness of security assessments

Requirements

• Minimum 3 years in application security, IT security, or software development with a security focus
• Hands-on experience with penetration testing, vulnerability assessments, and secure code reviews
• Proven experience with SAST, DAST, and threat modelling frameworks
• Practical knowledge of secure software development practices (OWASP Top 10, CWE)
• Hands-on development experience or scripting ability (Python, JavaScript, Bash)
• Strong understanding of web application security, API security, and cloud security concepts (AWS, Azure, or GCP)
• Understanding of DevSecOps principles and CI/CD security integration
• Excellent communication skills with ability to explain complex security concepts to technical and non-technical audiences
• Collaborative mindset with ability to work cross-functionally
• Bachelor's degree in Computer Science, Information Security, Cybersecurity, Software Engineering, or a related technical field
• Relevant coursework or self-study in application security, cryptography, or secure software development