Application Security Engineer

Emagine is a company working with leading international clients on innovative and high-impact projects. They value diversity, inclusion, and equal opportunities and offer a dynamic and forward-thinking environment.

• Proven experience performing penetration tests on web applications and APIs.
• Hands-on experience with SAST, DAST, and SCA tools and integration into CI/CD pipelines.
• Working knowledge of CI/CD platforms, ideally Jenkins, including troubleshooting pipeline and security scanner integration issues.
• Experience with threat modelling and secure design reviews.
• Strong understanding of vulnerability classes, including OWASP Top 10, and remediation techniques.
• Excellent written communication skills to produce clear security reports.
• Ability to train and collaborate with developers explaining security issues practically.
• Strong autonomy and initiative in addressing security challenges.
• Professional fluency in English.
• Short availability to start the project.

Nice to have:

• Security certifications such as OSCP, GWAPT, CEH, or CSSLP.
• Experience defining or improving security processes and governance.
• Scripting or programming skills such as Python or Bash for automation.
• Familiarity with cloud and containerised environments.

• Plan and conduct penetration tests on internal applications and deliver clear, detailed reports.
• Produce security assessment reports covering risk assessment, vulnerability impact, exploitation steps, and actionable remediation guidance.
• Integrate SAST, DAST, and SCA scanning into CI/CD pipelines and support developers in using these tools effectively.
• Troubleshoot and resolve CI/CD issues related to security scanning, including Jenkins configuration, scanner failures, authentication issues, and pipeline execution errors.
• Support development teams with threat modelling, security reviews, and pre-release security assessments.
• Help development teams resolve security blockers before application releases.
• Define and standardise security engagement procedures and promote secure development practices.
• Act as a trusted security partner to engineering teams, providing practical and constructive security guidance.

Candidates must be based in Portugal and should be available to start ASAP.