Senior Application Security Engineer

About the role

The Senior Application Security Engineer ensures that the organization’s products are secure throughout their lifecycle. The role works closely with product, engineering, and business teams to embed security best practices from design to production.

Key responsibilities

• Perform threat modelling, vulnerability assessments, and risk mitigation for application designs.
• Implement security tooling and automation to scale Application Security practices across the SDLC.
• Conduct code reviews, penetration testing, static and dynamic analysis, and ensure compliance with standards such as SOC2, HIPAA, PCI DSS, SOX, ISO 27001, and NIST CSF.
• Design and integrate security controls into products, CI/CD pipelines, and infrastructure‑as‑code scanning.
• Collaborate with cross‑functional teams on product road‑maps, develop mitigation strategies, and provide security training and awareness.
• Maintain documentation of security controls, prepare risk reports for management and regulators, and audit critical code changes.

Required profile

• 5+ years of experience in application security.
• Bachelor’s degree in Computer Science, Cybersecurity, or a related field.
• Proven experience leading architectural changes or cross‑team security initiatives.
• Strong understanding of threat‑modelling methodologies (MITRE ATT&CK, STRIDE, PASTA) and cloud platforms (AWS, Azure).
• Experience with web‑application security, orchestration tools (Ansible, Terraform), and security frameworks (OWASP Top 10).
• Fluency in Python, React, and Django Rest Framework, with hands‑on source‑code review experience.
• Excellent communication and interpersonal skills.

Required skills

• Threat modelling (MITRE ATT&CK, STRIDE, PASTA)
• Amazon AWS
• Microsoft Azure
• Web application security
• Ansible
• Terraform
• OWASP Top 10
• SAST and DAST tools
• Software composition analysis (SCA)
• CI/CD pipeline integration
• Python
• React
• Django Rest Framework
• Manual source‑code review
• Application security tool deployment
• Infrastructure‑as‑code scanning