We are seeking a Senior Application Security Engineer to enhance our security team. In this role, you will be instrumental in developing and refining our application security program by setting secure development standards and integrating security into the software development lifecycle (SDLC). You will collaborate closely with development, DevOps, and DevSecOps teams to ensure that security is prioritized from the beginning, facilitating the creation of robust and secure applications.

Responsibilities

• Configure and utilize tools such as SAST, DAST, IAST, and RASP.
• Manage vulnerabilities by maintaining systems and ensuring they are secure.
• Review open-source code for security vulnerabilities (OSA/SCA).
• Conduct and enhance code security reviews.
• Strengthen API security (REST, GraphQL).
• Perform threat modeling (STRIDE, PASTA, etc.) for new features.
• Launch and manage the bug bounty program.
• Develop a "Security Champions" initiative across engineering teams.
• Collaborate with external teams on penetration testing.
• Share your security expertise with the wider team.

Requirements

• Minimum of 5 years in Application Security or a related security role.
• Proficient with SAST/DAST/IAST/RASP tools, particularly Snyk and/or Acunetix.
• Practical experience with vulnerability management and threat modeling (STRIDE, PASTA).
• Experience in launching or managing a bug bounty program.
• Familiarity with penetration testing or collaboration with pentest teams.
• Strong knowledge of OWASP standards (ASVS, WSTG, etc.) and SSDLC principles.
• Expertise in API security (REST, GraphQL).
• Ability to read and understand code in PHP, JS, Go, C#, and C++ (especially Unity for desktop/mobile).
• Comprehensive understanding of application and infrastructure security.

Nice to Have

• Security certifications such as OSCP, GWEB, CSSLP.
• Experience with Unity/game engine security.
• Familiarity with cloud security (AWS, AliCloud).
• Knowledge of integrating security checks into CI/CD pipelines (GitHub Actions).
• Experience in building a Security Champions program.

This is a fully remote position, and candidates must be permanently residing and authorized to work in Germany, France, or the United Kingdom.