Application Security Engineer

Role Overview

• Perform threat modeling, security architecture review, and design analysis for web applications and APIs.
• Conduct manual and automated security testing during development and pre-release stages.
• Design and implement security pipelines (including SAST and DAST) and integrate them into the SDLC process.
• Implement and manage SBOM generation and consumption processes across the SDLC.
• Collaborate with development teams to ensure timely remediation of identified vulnerabilities.
• Maintain security guidance aligned with OWASP best practices and provide trainings for development teams.
• Stay current with evolving application security threats, tools, and industry developments.

Requirements

• 3–5 years of experience in application security, with a focus on web applications and API security.
• Good knowledge of at least one scripting or programming language (e.g., Python, JavaScript, C#, or Go).
• Experience with tools like OWASP ZAP, Burp Suite, Snyk, or similar.
• Familiarity with secure coding, DevSecOps, and container security concepts.
• Strong understanding of CVE, CVSS, and vulnerability disclosure workflows.
• Excellent command of business English.
• Preferred Qualifications:
• Knowledge of SBOM standards (CycloneDX, SPDX) and experience integrating SBOM tooling into CI/CD pipelines.
• Knowledge of software composition analysis (SCA) tools.

Tech Stack

• JavaScript
• Python
• SDLC
• Go

Benefits

• 💻 Choice of work equipment (e.g., laptop, monitor, etc.)
• 🇬🇧 English classes (iTalki – $130 monthly)
• ⏰ Flexible schedule (we usually work between 09:00/10:00 and 18:00/19:00 CET or EET)
• 👶 Newborn bonus (€500 per child)
• 🧠 Patent remuneration
• 🌴 Paid leave
• 🧑‍💻 Remote work in locations without our offices
• Hybrid work in locations with offices (2 days in-office, 3 days remote)