Senior Application Security Engineer
Core
Own application security across Product Engineering, securing codebases, tooling pipelines, and incident response for Marketplace, Payments, and SaaS products.
Role type
Senior IC application security engineer (DevSecOps)
Builds
Secure codebases, security tooling pipelines (SAST, secrets detection, DefectDojo), and secure defaults for authentication, sessions, and payments flows.
Domain
Application security, DevSecOps, marketplace, payments, SaaS
Required skills
Application security (OWASP ASVS, Top 10), SAST/dependency scanning/secrets detection in CI, threat modelling, vulnerability management, code review (Java, Ruby, TypeScript), incident response, AWS/Kubernetes basics
Preferred skills
PCI DSS/GDPR experience, bug bounty/CTF/pentesting background, offensive security certifications
Technologies
Java, Spring Boot, Ruby on Rails, React, TypeScript, Swift, Kotlin, PHP, GitLab CI, GitHub Actions, Kubernetes (EKS), AWS, Datadog, DefectDojo
Responsibilities
Remediate vulnerabilities in codebases, own security tooling and pipelines, run threat modelling, triage scanner findings, lead application-layer incident response, manage security vendor relationships, act as security reviewer for third-party risk, present security posture to leadership, grow Security Champions programme
Seniority
Senior, hands-on IC
