Application Security Engineer

The candidate will have responsibilities across the following functions:

Application Security:

• Perform application vulnerability assessments on web applications and APIs.
• Execute security scans using SAST, DAST and dependency scanning tools.
• Validate security findings, eliminate false positives, and work with developers to remediate vulnerabilities.
• Assist with secure code reviews and learn to identify common coding vulnerabilities.
• Help integrate security testing into the software development lifecycle.
• Support external penetration testing engagements and track remediation activities.
• Contribute to improving secure coding practices across engineering teams.
• Document security findings and recommend practical remediation steps.

Governance, Risk and Compliance:

• Assist with maintaining SOC 2 and ISO 27001 compliance activities.
• Support audit evidence collection and security documentation.
• Help maintain security policies and standards.
• Participate in customer security questionnaires and vendor security assessments.
• Support periodic security risk assessments when required.

Requirements:

• 2 to 4 years of experience in Application Security, Cyber Security, DevSecOps, Security Operations, or a similar security-focused role.
• Good understanding of common web application security vulnerabilities, including the OWASP Top 10
• Exposure to application security testing tools such as Burp Suite, OWASP ZAP, Snyk, SonarQube, Checkmarx, Veracode, or similar.
• Basic understanding of web technologies, REST APIs, authentication mechanisms, and secure development concepts.
• Ability to read and understand application code for security analysis (experience with at least one language such as Java, Python, JavaScript, Go or C#).
• Strong analytical and problem-solving skills.
• Ability to collaborate with software engineers to improve application security.
• Comfortable using GenAI tools to assist with security reviews, vulnerability analysis, secure code review, and security documentation.