Senior Application Security Engineer

Security Architecture & Threat Modelling: • Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams • Act as a security force multiplier by influencing the standards, patterns, and guardrails that let teams move fast and stay secure Security Automation & Tooling: • Design, build, and automate scalable security processes that engineering teams can self-serve, covering secure design review, threat modelling, testing, and remediation workflows • Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning), tuned for strong signal and low friction • Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms, maximising automation, coverage, and integration • Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define how the team adopts these tools safely Security Testing & Vulnerability Management: • Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development • Run vulnerability scans across internal infrastructure and the external perimeter, then analyse findings, define remediation, and track issues to closure • Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible • Participate in and help lead red teaming and offensive security exercises Enablement: • Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams

Experience: • 5+ years in application or product security, or equivalent depth, with a track record of senior or staff-level impact • Demonstrable experience leading security architecture reviews and threat modelling (e.g. STRIDE, attack trees, data-flow analysis) across multiple teams or products • Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort Technical: • Strong hands-on security testing skills, including code review and web, mobile, and API application security assessments, as well as the ability to triage and validate external vulnerability reports and bug bounty submissions • Strong software engineering ability in at least one language (e.g. Python, Go, JavaScript), with the ability to build automation, not just scripts • Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices • Experience with SAST, DAST, SCA, and vulnerability management platforms, and integrating them into CI/CD • Strong understanding of modern application architectures: REST APIs, microservices, cloud-based systems, and containers • Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so Collaboration: • Excellent communication and influencing skills: you can explain security concepts to technical and non-technical stakeholders and drive change without direct authority • A self-starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture

Responsibilities: Security Architecture & Threat Modelling: • Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams • Act as a security force multiplier by influencing the standards, patterns, and guardrails that let teams move fast and stay secure Security Automation & Tooling: • Design, build, and automate scalable security processes that engineering teams can self-serve, covering secure design review, threat modelling, testing, and remediation workflows • Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning), tuned for strong signal and low friction • Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms, maximising automation, coverage, and integration • Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define how the team adopts these tools safely Security Testing & Vulnerability Management: • Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development • Run vulnerability scans across internal infrastructure and the external perimeter, then analyse findings, define remediation, and track issues to closure • Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible • Participate in and help lead red teaming and offensive security exercises Enablement: • Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams Requirements: Experience: • 5+ years in application or product security, or equivalent depth, with a track record of senior or staff-level impact • Demonstrable experience leading security architecture reviews and threat modelling (e.g. STRIDE, attack trees, data-flow analysis) across multiple teams or products • Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort Technical: • Strong hands-on security testing skills, including code review and web, mobile, and API application security assessments, as well as the ability to triage and validate external vulnerability reports and bug bounty submissions • Strong software engineering ability in at least one language (e.g. Python, Go, JavaScript), with the ability to build automation, not just scripts • Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices • Experience with SAST, DAST, SCA, and vulnerability management platforms, and integrating them into CI/CD • Strong understanding of modern application architectures: REST APIs, microservices, cloud-based systems, and containers • Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so Collaboration: • Excellent communication and influencing skills: you can explain security concepts to technical and non-technical stakeholders and drive change without direct authority • A self-starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture Nice to have: • Experience securing the AI harness: hardening LLM and agent pipelines, prompts, tool and MCP integrations, and model endpoints against prompt injection, data leakage, and insecure agent actions • Experience securing Kubernetes, including cluster hardening, RBAC, network policies, admission control, workload isolation, and image and supply-chain security • Experience securing AWS infrastructure, including IAM, network and account architecture, key and secret management, and CSPM • Experience building AI-assisted security tooling or internal self-service security platforms • Experience mentoring or technically leading a security team • Offensive or advanced security certifications such as OSAI, OSEP, OSCP, or OSWE What you'll get in return: • You will join the company, that cares about work and life balance • Annual Bonus based on the performance review cycle • Generous Annual Leave Policy • Medical Insurance and Pension fund, with additional benefit packages based on the location • Hybrid working model (3 days from our modern office and 2 days fully remotely) • Comprehensive Workation Policy with 30 more remote days available. • Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.