Application Security Engineer

Own and deliver application security assurance for internally developed products, integrating security practices throughout the SDLC.

Embed security checks into CI/CD pipelines, including SAST, DAST, software composition analysis, and secret detection, to identify vulnerabilities early and support timely remediation.

Promote shift-left security by advising development teams on secure design, implementation, and coding practices.

Conduct targeted code reviews to uncover flaws before formal penetration testing.

Collaborate with the Infrastructure Security Specialist to validate vulnerabilities and risk scenarios ahead of formal testing.

Review third-party penetration test results, validate findings, prioritize risks, and recommend practical remediation.

Conduct threat modeling and help strengthen the security of APIs, web applications, and modern application architectures.

Work with engineering teams to track remediation and improve security practices across development and release workflows.

Communicate technical findings clearly, translating vulnerabilities into business and operational risks.

Solid knowledge of web and API security principles, including the OWASP Top 10 and OWASP API Security Top 10.

Familiarity with modern application architectures, especially authentication, authorization, and session management.

Ability to read and understand code in languages such as Python, Java, or JavaScript.

Experience with application security testing tools such as Burp Suite, OWASP ZAP, Postman, and proxy debuggers.

Understanding of threat modeling, business logic vulnerabilities, and risk-based prioritization.

Knowledge of CI/CD security practices, including integrating SAST, DAST, and open-source dependency scanning into development workflows.

Strong communication skills, with the ability to explain technical vulnerabilities and remediation options to varied audiences.