Senior Application Security Engineer – Bucharest

About the role

Infosys is looking for a Senior Application Security Engineer to lead security assessments and drive secure software development across its Romanian delivery sites. The role combines hands‑on testing, vulnerability management and advisory services to ensure applications are protected throughout the development lifecycle.

Key responsibilities

• Perform application security assessments using SAST, DAST, SCA, penetration testing, API security testing and manual reviews for web, cloud and enterprise applications.
• Validate findings, conduct false‑positive analysis, retest remediated issues and report on remediation effectiveness.
• Lead vulnerability management activities – identification, prioritisation, tracking and reporting – using business impact, exploitability and threat intelligence.
• Advise development teams on secure coding practices, remediation strategies and integration of security testing into CI/CD pipelines and DevSecOps processes.
• Support application security governance, risk assessments, threat modelling, secure design reviews and compliance/audit activities.
• Develop and maintain security dashboards and metrics covering vulnerability trends, MTTR, SLA compliance and testing coverage.
• Communicate security risks and remediation priorities to both technical and non‑technical stakeholders.

Required profile

• Bachelor’s or Master’s degree in Computer Science, Cybersecurity, Information Technology or equivalent experience.
• 10 + years of experience in application security, security testing or vulnerability management.
• Proven ability to lead security assessments and drive remediation in complex, multi‑site environments.
• Strong analytical skills and experience communicating security concepts to diverse audiences.

Required skills

• SAST, DAST, SCA, penetration testing, API security testing.
• Vulnerability management and prioritisation.
• CI/CD pipeline integration and DevSecOps practices.
• Secure SDLC, secure coding guidance and threat modelling.
• Security metrics, dashboards and reporting (MTTR, SLA).