Application Security Engineer AppSec
Core
Secure web applications, APIs, and backend services by embedding security into the SDLC and coordinating cross-platform risks.
Role type
Application Security Engineer
Builds
Secure web applications, APIs, and backend services
Domain
Fintech / Insurance
Required skills
OWASP Top 10, API security, secure design, SAST/DAST, dependency scanning, threat modeling, secure SDLC, vulnerability management
Preferred skills
Penetration testing, secure coding guidance, developer security awareness
Technologies
Burp Suite, OWASP ZAP, TypeScript, Node.js, Python, Swift, Kotlin, AWS, GCP
Responsibilities
Perform security reviews, code reviews, and testing for web applications, APIs, and backend services; Identify, prioritize, and help remediate injection, broken access control, authentication, and configuration vulnerabilities; Integrate SAST, DAST, software composition analysis, and secrets scanning into CI/CD pipelines; Conduct threat modeling and design reviews for features, APIs, third-party integrations, and major changes; Coordinate with mobile engineers on cross-platform findings and backend controls protecting native iOS and Android clients; Own application security implementation for SC TRM and BNM RMiT, including secure SDLC evidence, vulnerability management, testing, and audit remediation; Provide secure coding guidance, track remediation, retest fixes, and improve developer security awareness.
