Application Security Engineer

The Cybersecurity team is a strategic function within Toyota Motor Europe's IT & Digital division, supporting the transformation of Toyota’s European IT operations. The team focuses on building resilient security frameworks, managing cyber risks in a modern enterprise environment, and fostering a proactive security culture across digital assets and operations.

• Relevant experience in Application Security, Penetration Testing, Secure Software Development, or closely related area
• Experience working in large and/or complex environments with a range of stakeholders
• Experience as a developer, architect, security engineer, or another relevant background with exposure to the software development lifecycle
• Good understanding of application security vulnerabilities and remediation techniques
• Experience performing threat modelling with development teams
• Practical programming experience in at least one language
• Ability to help integrate and scale security testing within CI/CD pipelines

Nice to have:

• Familiarity with frameworks such as SAMM, BSIMM, NIST SSDF
• Knowledge of Cloud security (AWS, Azure, GCP)
• Container and Kubernetes security
• CSSLP, OSCP, or equivalent security certifications

• Integrate security practices into development pipelines, including SAST/DAST and CI/CD security controls
• Promote secure-by-design principles and “shift-left” engineering practices across teams
• Conduct threat modelling for applications and projects, defining mitigation strategies and security requirements
• Support teams in identifying and remediating vulnerabilities effectively
• Act as a trusted application security partner for development teams and projects
• Translate complex technical risks into clear, actionable guidance for technical and non-technical stakeholders
• Help grow a Security Champions community and strengthen security awareness across engineering teams
• Support and coach engineers in strengthening secure coding practices and shared ownership of security
• Collaborate with security experts and cross-functional teams to share best practices and standardise approaches
• Contribute to documentation, guidelines, and reusable security assets
• Measure and improve application security maturity (e.g., using models such as SAMM)
• Provide regular reporting on security posture, risks, and improvement actions