Conduct web and mobile application security assessments and API security testing
Perform threat modelling, secure code reviews, and attack surface analysis
Support SAST and DAST initiatives
Assist in managing the vulnerability lifecycle
Coordinate internal and external security assessments, ensuring proper scoping and timely delivery
Track and report on remediation progress
Ensure secure coding practices are followed
Collaborate with developers, testers, and business analysts to provide proactive security guidance during development sprints
Contribute to security frameworks, checklists, and guidelines (aligned with OWASP, NIST, MITRE)
Work on DevSecOps testing and protective controls
Assist in the investigation and resolution of application security incidents
Contribute to post-incident analysis and implement preventative measures
Stay informed about cybersecurity trends, emerging threats, and attack vectors

Minimum 3 years in application security, IT security, or software development with a security focus
Hands-on experience with penetration testing, vulnerability assessments, and secure code reviews
Proven experience with SAST, DAST, and threat modelling frameworks
Practical knowledge of secure software development practices (OWASP Top 10, CWE)
Hands-on development experience or scripting ability (Python, JavaScript, Bash)
Strong understanding of web application security, API security, and cloud security concepts (AWS, Azure, or GCP)
Understanding of DevSecOps principles and CI/CD security integration
Excellent communication skills with the ability to explain complex security concepts to technical and non-technical audiences
Collaborative mindset with the ability to work cross-functionally

Application Security Engineer

Key skills