Application Security Engineer

We are looking for a professional with prior experience in software development and application architecture, who has transitioned into application security roles. The ideal candidate should possess the ability to interact with development teams, architecture, operations, and corporate security, while acting simultaneously as a technical consultant, facilitator, and promoter of best practices.

The candidate must be capable of understanding code, architecture, and development processes, directly supporting the analysis and resolution of identified vulnerabilities.

Main Responsibilities:

The successful candidate will be responsible for:

• Defining and promoting Secure SDLC practices.

• Integrating security requirements into the development cycle.

• Participating in architecture and solution design reviews.

• Conducting threat modeling sessions.

• Supporting teams in implementing authentication, authorization, and data protection mechanisms.

• Analyzing results from pentests, vulnerability assessments, SAST, DAST, dependency scanning, and container scanning.

• Classifying and prioritizing vulnerabilities.

• Providing technical support for remediation efforts.

• Overseeing correction plans and associated SLAs.

• Defining test scopes and coordinating with external vendors for penetration tests.

• Validating findings and ensuring follow-up and closure of recommendations.

• Conducting Secure Coding workshops and promoting OWASP Top 10 and secure development best practices.

• Supporting the development of Security Champions within teams and producing technical guidelines and standards.

• Integrating security controls into CI/CD pipelines.

• Promoting automation of security checks and defining application security metrics and indicators.

Key Requirements:

• Solid experience in at least one of the following technology stacks: Java - Spring Boot; REST APIs; Maven and/or C# - .NET Framework / .NET Core; ASP.NET.

• Basic knowledge of Linux OS and Shell Scripting, including Linux hardening.

• Mandatory cloud knowledge with real deployment experience; desirable knowledge in at least one major cloud platform, preferably AWS and/or Azure.

• Practical knowledge of OWASP Top 10, OWASP ASVS, Secure Coding practices, Threat Modeling, Authentication & Authorization, including OAuth2, OpenID Connect, JWT, API Security, Secure API Design, applied cryptography (TLS, secure hashing), and secrets management.

• Experience with tools such as SonarQube, Checkmarx, Fortify, Veracode, Snyk, Dependabot, OWASP ZAP, Burp Suite, and Trivy.

Nice to Have:

• Strong communication skills.

• Ability to influence without hierarchical authority.

• Capacity for training and mentoring.

• Pragmatism in risk management.

• Ease of collaboration with development teams.

• Strong analytical skills.