Application Security Engineer (Remote)

Introduction & Summary

We are seeking an experienced Application Security Engineer to enhance our application security posture. The ideal candidate will possess a proven track record in performing penetration tests and vulnerability assessments, with hands-on experience integrating security tools into CI/CD pipelines. This role requires strong communication skills to produce clear security reports and guide development teams in secure coding practices.

Main Responsibilities

• Plan and conduct penetration tests on internal applications, and deliver clear, detailed reports.

• Produce security assessment reports covering risk assessment, vulnerability impact, exploitation steps, and actionable remediation guidance for development teams.

• Integrate SAST, DAST, and SCA scanning into CI/CD pipelines, and train developers to use these tools effectively.

• Troubleshoot and resolve CI/CD issues related to security scanning, including Jenkins configuration, scanner failures, authentication problems, and pipeline execution errors.

• Support development teams with threat modeling, security reviews, and pre-release security assessments, helping resolve security blockers before launch.

• Define and standardize security engagement procedures so teams know how and when to involve Security.

• Act as a trusted security partner to engineering teams, promoting secure development practices.

Key Requirements

• Proven experience performing penetration tests on web applications and APIs.

• Hands-on experience with SAST, DAST, and SCA tools and their integration into CI/CD pipelines.

• Working knowledge of CI/CD platforms, ideally Jenkins, including troubleshooting pipeline and scanner integration issues.

• Experience with threat modeling and secure design reviews.

• Strong understanding of common vulnerability classes (e.g., OWASP Top 10) and remediation techniques.

• Excellent written communication, with the ability to produce clear, structured security reports for both technical and non-technical audiences.

• Ability to train and collaborate with developers, and to explain security issues in a practical, constructive way.

Nice to Have

• Security certifications (e.g., OSCP, GWAPT, CEH, CSSLP).

• Experience defining or improving security processes and governance.

• Scripting or programming skills (e.g., Python, Bash) for automation.

• Familiarity with cloud and containerized environments.

• Short availability to start the project

Other Details

This is a remote position with flexible working hours. Candidates are expected to have the ability to work independently and demonstrate initiative in identifying and addressing security challenges.