Senior Application Security Engineer

<h3>Responsibilities:</h3><h2>Security Architecture &amp; Threat Modelling:</h2><ul>
<li>Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams</li>
<li>Act as a security force multiplier by influencing the standards, patterns, and guardrails that let teams move fast and stay secure</li>
<h2>Security Automation &amp; Tooling:</h2>
<ul>
<li>Design, build, and automate scalable security processes that engineering teams can self-serve, covering secure design review, threat modelling, testing, and remediation workflows</li>
<li>Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning), tuned for strong signal and low friction</li>
<li>Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms, maximising automation, coverage, and integration</li>
<li>Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define how the team adopts these tools safely</li>
<h2>Security Testing &amp; Vulnerability Management:</h2>
<ul>
<li>Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development</li>
<li>Run vulnerability scans across internal infrastructure and the external perimeter, then analyse findings, define remediation, and track issues to closure</li>
<li>Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible</li>
<li>Participate in and help lead red teaming and offensive security exercises</li>
<h2>Enablement:</h2>
<ul><li>Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams</li></ul>
</ul>
</ul>
</ul>
<h3>Requirements:</h3><h2>Experience:</h2><ul>
<li>5+ years in application or product security, or equivalent depth, with a track record of senior or staff-level impact</li>
<li>Demonstrable experience leading security architecture reviews and threat modelling (e.g. STRIDE, attack trees, data-flow analysis) across multiple teams or products</li>
<li>Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort</li>
<h2>Technical:</h2>
<ul>
<li>Strong hands-on security testing skills, including code review and web, mobile, and API application security assessments, as well as the ability to triage and validate external vulnerability reports and bug bounty submissions</li>
<li>Strong software engineering ability in at least one language (e.g. Python, Go, JavaScript), with the ability to build automation, not just scripts</li>
<li>Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices</li>
<li>Experience with SAST, DAST, SCA, and vulnerability management platforms, and integrating them into CI/CD</li>
<li>Strong understanding of modern application architectures: REST APIs, microservices, cloud-based systems, and containers</li>
<li>Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so</li>
<h2>Collaboration:</h2>
<ul>
<li>Excellent communication and influencing skills: you can explain security concepts to technical and non-technical stakeholders and drive change without direct authority</li>
<li>A self-starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture</li>
</ul>
</ul>
</ul>
<h3>Nice to have:</h3><ul>
<li>Experience securing the AI harness: hardening LLM and agent pipelines, prompts, tool and MCP integrations, and model endpoints against prompt injection, data leakage, and insecure agent actions</li>
<li>Experience securing Kubernetes, including cluster hardening, RBAC, network policies, admission control, workload isolation, and image and supply-chain security</li>
<li>Experience securing AWS infrastructure, including IAM, network and account architecture, key and secret management, and CSPM</li>
<li>Experience building AI-assisted security tooling or internal self-service security platforms</li>
<li>Experience mentoring or technically leading a security team</li>
<li>Offensive or advanced security certifications such as OSAI, OSEP, OSCP, or OSWE</li>
</ul><h3>What you'll get in return:</h3><li>You will join the company, that cares about work and life balance</li><li>Annual Bonus based on the performance review cycle</li><li>Generous Annual Leave Policy</li><li>Medical Insurance and Pension fund, with additional benefit packages based on the location</li><li>Hybrid working model (3 days from our modern office and 2 days fully remotely)</li><li>Comprehensive Workation Policy with 30 more remote days available.</li><li>Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.</li>