Application Security Engineer

• Define security requirements and design application architectures following a secure-by-default approach.

• Conduct threat modeling, code reviews, and penetration testing on cloud-based web and mobile apps to proactively identify vulnerabilities.

• Implement, manage, and automate SAST/DAST/SCA security controls and WAF rules to enforce protection at scale.

• Partner with Product teams to ensure robust protection and foster a security-first development culture.

• Participate in the investigation, management, and resolution of security alerts.

• Collaborate on all core activities and initiatives of the Security Engineering team.

• Strong knowledge of web/mobile security vulnerabilities, AI security risks, and industry standards (e.g., OWASP Top 10, CWE).

• Hands-on experience with threat modeling frameworks (e.g., STRIDE), code reviews, penetration testing, and SAST/DAST/SCA tools.

• Proficiency in scripting/programming (e.g., Python, Rust) and experience with CI/CD systems and Infrastructure as Code (e.g., Pulumi).

• Availability for on-call shifts to guarantee 24x7 security monitoring and support.

• Self-motivated and proactive problem-solvers with strong English communication skills and experience in Agile environments.

• Practical experience with secure AWS design/implementation and Kubernetes (EKS) security.

• Hands-on experience with WAF configurations (e.g., Cloudflare) and EDR, SIEM, or SOAR platforms.

• Relevant industry certifications (e.g., OSCP, OSWA/E, BSCP, PWPA/E, eWPT, or similar).

• Active involvement in security research, bug bounty programs, or CTF competitions.