Senior Application Security Engineer

This is a fully remote position, open to applicants in Spain.

📋 Description

• Take ownership of application security within Product Engineering and address vulnerabilities in codebases.

• Manage security tools such as secrets detection, dependency scanning, SAST, DefectDojo, and threat modeling.

• Execute SAST vendor proof of concept with pilot teams and adjust rules to enhance developer trust.

• Incorporate findings into DefectDojo and automate team ownership, repository coverage, and pipeline-blocking rules.

• Establish secure defaults within shared libraries and pipeline templates for authentication, session management, input validation, secrets, dependency, and container checks.

• Conduct threat modeling and create owned, dated backlog items.

• Assess scanner, penetration-test, and external findings, and monitor remediation until closure in accordance with severity SLAs.

• Lead application-layer incident response, evaluate potential personal-data exposure with Legal, draft postmortem actions, and assist with fraud, phishing, and customer-reported cases.

• Manage penetration-testing, responsible disclosure, security inbox, and SAST vendor relationships.

• Evaluate third-party risks and respond to partner security questionnaires.

• Quantify and present security posture to the CTO and VP of Engineering.

• Enhance the Security Champions program and coordinate quarterly security improvements.

• Develop and communicate a Now/Next/Later security roadmap.

⛳️ Requirements

• Proven experience as an application security engineer or as a backend engineer responsible for product security.

• Proficiency in reading and writing production code in at least one of the following: Java, Ruby, or TypeScript.

• Familiarity with OWASP ASVS and OWASP Top 10.

• Experience in running threat models that generate actionable backlog items.

• Background in integrating SAST, dependency scanning, or secrets detection into GitLab CI or GitHub Actions pipelines.

• Experience with vulnerability management platforms.

• Understanding of authentication, sessions, authorization, payment flows, IDOR, token and magic-link misuse, JWT validation errors, race conditions, injection, and device-ID collisions.

• Knowledge of AWS and Kubernetes to identify application/platform security boundaries.

• Capability to communicate security risks to both technical and non-technical stakeholders.

• Proficient in using AI tools for threat modeling, code review, and navigating unfamiliar codebases.

• Nice to have: experience with marketplace, payments, or SaaS businesses handling card and personal data under PCI DSS and GDPR.

• Nice to have: background in bug bounty programs, CTFs, penetration testing, or certifications like OSCP, OSWE, or BSCP.

• Nice to have: experience with Security Champions programs.

• Nice to have: familiarity with the OWASP DevSecOps Maturity Model or other maturity frameworks.

• Nice to have: knowledge of WAF, bot protection, secrets management, infrastructure-as-code scanning, AWS, Spring Security, Rails security internals, or custom SAST rules.

🏝️ Benefits

• 28 days of holiday, in addition to bank holidays.

• Monthly €40 Treatwell vouchers.

• Mental health support through a partnership with Open-Up.

• Market-specific benefits to be discussed during the interview process.