Application Security Engineer
Core
Embed application security across the delivery lifecycle by leading secure design reviews, performing code reviews, tuning security tooling in CI/CD, managing vulnerabilities, and enabling developers.
Role type
Application Security Engineer (DevSecOps)
Builds
Secure software delivery pipelines, secure code, and risk-reduced applications for financial services
Domain
Financial services / Application Security
Required skills
Application security, Secure SDLC/DevSecOps, SAST/DAST/SCA tooling, Threat modelling, Code review (Java/C#/JS/Python), OAuth2/OpenID/SAML, Cloud security (AWS/Azure), Secrets management
Preferred skills
Financial services experience, PCI DSS/ISO 27001 knowledge, Penetration testing management, AI/LLM security, Secure coding standards development
Technologies
GitHub, Azure DevOps, AWS, Azure, SAST, DAST, SCA, OAuth 2.0, OpenID Connect, SAML
Responsibilities
Lead secure design reviews and threat modelling; Perform manual and tool-assisted code reviews; Integrate security tooling into CI/CD pipelines; Triage and track application vulnerabilities; Develop and maintain application security standards; Coordinate penetration testing and red team engagements; Manage responsible disclosure programs; Support AI security reviews; Maintain software bill of materials; Enable developers through training and security champions; Report security metrics; Support audit and compliance obligations
Seniority
Mid-Senior, hands-on IC
