Senior Application Security Engineer

We are looking for an Application Security Engineer in the AppSec team.

As a Senior Application Security Engineer at inDrive, you will own whole areas of our AppSec program, from security requirements and design reviews to controls that work in production. You will work with product, platform and infrastructure teams on new architecture, AI systems and the security of our apps and services. The role fits a hands-on engineer who reviews code and architecture, leads work across several teams and makes security decisions based on data.

Key Responsibilities

• Own one or more areas of the AppSec program end to end, including the plan, the risks and the metrics.
• Run security design reviews and threat modeling of new features, services and AI systems, and defend security requirements at the architecture committee.
• Assess the security of web, mobile and API applications and find variants of confirmed vulnerabilities across other services.
• Coordinate external security assessments and bug bounty findings, from triage and prioritisation with teams to fix verification.
• Design secure authentication and authorization between users, services and internal tools together with platform teams.
• Choose, pilot and tune security tools, and keep only those that pay off in real findings.
• Turn incidents and assessment results into lasting controls, policies and secure defaults for developers.
• Consult development teams on complex security issues and take shifts in AppSec duty for Critical and High incidents.

Skills, Knowledge and Expertise

• Higher education in IT, preferably in information security.
• Knowledge of mobile application security on Android and iOS, client-server trust, app integrity and protection against bots and account takeover.
• Deep knowledge of web and API security, including authentication and authorization flaws, SSRF, injections and business logic issues, and the ability to find variants of a vulnerability class across many services.
• Strong understanding of identity and access, OAuth 2.0, OIDC, JWT, signing key rotation, mTLS, service-to-service authentication and SSO.
• Understanding of security risks of AI systems and LLM agents, such as prompt injection, excessive tool permissions and agent access to sensitive data, and practical use of AI in your own security work.
• Practical understanding of cloud-native infrastructure, Kubernetes, containers, API gateways and AWS.
• Experience in threat modeling and security design review of new features and architecture.
• Understanding of vulnerability management and risk, including severity, SLA, compensating controls and risk acceptance.
• Ability to read and review code in at least one language, preferably Golang.
• Track record of leading projects with two or more teams from a requirement to a verified fix, and clear written English.
• Experience with secrets and key management, rotation and response to credential leaks.

Nice to have

• Knowledge of software supply chain security, dependencies, CI/CD pipelines and source control platform hardening.
• Experience tuning SAST, DAST and SCA tools for precision and judging a tool by noise and cost per real finding.

Why join us

• Help us challenge injustice by creating fair choices for millions of people across 47 countries.
• Develop your professional skills with access to mentoring, career consulting, and learning programs.
• Collaborate with teams around the world and gain international experience through our Global Talent Exchange Program.
• Engage in company-wide challenges, awards, sports activities, employee-led social impact and volunteering projects.
• Work alongside people who take initiative, speak openly, and challenge themselves to grow.
• Improve your language skills through co-financed courses and internal speaking clubs.
• Annual salary from 70 700 EUR gross.

Final benefits may vary depending on the location.