Senior Application Security Engineer

This is a fully remote position, open to applicants in United Kingdom.

📋 Description

• Assist in securing Prolific's applications comprehensively, encompassing hands-on testing, code reviews, threat modeling, and CI/CD security.

• Collaborate closely with engineers to identify and remediate vulnerabilities, develop and refine security tools, and integrate secure development methodologies throughout the software development lifecycle (SDLC).

• Conduct penetration tests, enhance detection capabilities, and proactively address emerging threats to continually bolster our security stance.

⛳️ Requirements

• Several years of experience in application/product security combined with a background in software engineering.

• In-depth knowledge of the OWASP Top 10 (Web & API) and current attack vectors (e.g., authentication flaws, SSRF, injection, business logic abuse, supply chain).

• Experience with complex, large-scale systems and contemporary architectures.

• Hands-on experience in security testing, particularly with Burp Suite, for web applications and APIs.

• Proficiency in Python for developing security tools, automation, or custom detection (experience with Django is a plus).

• Familiarity with implementing and optimizing SAST, SCA, DAST, and secret scanning within CI/CD pipelines.

• Practical experience in threat modeling, including leading concise sessions.

• Strong collaboration abilities, capable of clearly articulating issues and driving remediation efforts.

• A builder mindset, with a tendency to automate processes whenever feasible.

• Preferred qualifications: experience with Django, Vue.js, MongoDB, GCP, security champions or bug bounty programs, supply chain security (SCA, SBOMs, dependency review), IaC security (e.g., Terraform, policy-as-code), hands-on certifications (OSCP, GWAPT, BSCP), and experience in scaling environments to establish security practices.

🏝️ Benefits

• Competitive salary

• Flexible working hours

• Professional development budget

• Home office setup allowance

• Global team events