Application Security Engineer (f/m/d)

Overview

As AppSec Lead, you establish and drive our Application Security program within Product & Technology. You’ll evangelize AppSec, work with engineers and product managers to design secure products, and own the training and Security Champions initiatives to scale DevSecOps. You will integrate security into the SDLC, guide secure design and coding practices, and manage vulnerability lifecycle across internal and external apps. You’ll stay ahead of AI/LLM security trends and contribute to incident reviews and security playbooks.

Retribuzione / Benefits Flexi-Week with four-day structure

Hybrid/remote working setup

Monthly work expense allowance and home office furniture package

Health and wellbeing initiatives

Awin Academy training suite for professional growth

Peer-to-peer recognition programme

Responsabilità Secure the SDLC by integrating SAST, DAST and SCA into CI/CD pipelines and IDEs; automate checks to enable early fixes

Conduct threat modeling and secure design reviews with product and engineering teams

Provide guidance on secure coding, perform targeted code reviews, and assist with remediation

Manage vulnerability lifecycle across internal and external apps; track and report findings

Support bug bounty validation and present vulnerability reports to senior leaders

Provide security guidance for AI/ML/LLM features; manage risks like prompt injection and data leakage

Collaborate on incident investigations and post-incident mitigation strategies

Drive security culture; deliver trainings, workshops, and contribute to playbooks and standards

Research and innovate to reduce risks across software supply chain and showcase AI tool usage for security improvements

Requisiti fondamentali 5+ years in application security or related roles

Experience collaborating with engineers and product managers to secure web apps

Agile experience

Excellent English communication and interpersonal skills

Mentorship and training capabilities

Ability to work across two departments with multiple touchpoints

Coding proficiency in JS, PHP, Python

Experience with Cloud Native environments (AWS), Containers and Terraform

Hands-on experience with DAST, SAST, SCA, and reporting/dashboarding tools

Interpersonal communication

Mentorship and training

Cross-functional collaboration

SAST, DAST, SCA tooling

CI/CD integration

Threat modelling