Application Security Engineer (f/m/d)

About the role

Your role is to establish and lead an AppSec program within the Product and Technology department, acting as an evangelist for AppSec, trusted by engineers and managers alike. As a member of the core security team, you will engage in assessing application design proposals to identify improvements that enable engineers to create secure products.

Key responsibilities

• Integrate security tooling (SAST, DAST, dependency scanning) into CI/CD pipelines and IDEs, automating checks for early issue detection.
• Conduct threat‑modelling sessions and pre‑implementation security reviews during the design phase.
• Guide developers on secure coding, perform targeted code reviews, and provide actionable remediation.
• Identify, triage, track and report vulnerabilities across internal and external applications, supporting bug‑bounty validation.
• Provide guidance on secure development of AI/LLM‑powered features, managing risks such as prompt injection and data leakage.
• Support incident response by investigating application‑layer incidents and contributing to post‑incident reviews.
• Act as a security champion, delivering workshops, training, and maintaining the application security training program.
• Stay ahead of industry threats, propose innovative risk‑reduction ideas, and showcase AI‑powered security tools.

Required profile

• 5+ years of experience in application security, product security or related technical roles.
• Proven experience working directly with software engineers and product managers to secure web applications.
• Experience in Agile environments and strong English communication skills.
• Mentorship and training abilities, with a collaborative mindset across multiple departments.
• Coding proficiency in JavaScript, PHP and Python.
• Hands‑on experience with cloud‑native environments (AWS), containers and Terraform.
• Practical use of DAST, SAST and SCA tools, including reporting and dashboarding.

Required skills

• JavaScript
• PHP
• Python
• AWS
• Containers
• Terraform
• DAST
• SAST
• SCA

What we offer

• Flexi‑Week: four‑day work week with a lighter or disconnected day, full pay.
• Hybrid Flexi‑Office model supporting collaboration and autonomy.
• Monthly work‑expense contribution and remote‑working furniture package.
• Private medical insurance covering health, vision and dental treatments.
• Daily meal vouchers and a subsidy for screen‑working glasses.
• Access to global health and wellbeing initiatives, learning via Awin Academy, and peer‑to‑peer recognition programmes.