Application Security Engineer (F/M)

AXA IT Solutions is an internal software house operating within the international insurance group AXA. They provide IT solutions for the needs of AXA companies in Europe and work in English daily, in close-knit teams, carrying out international development projects.

• Strong practical knowledge of the OWASP Top 10 and common web application attack vectors.
• Deep understanding of securing modern web applications, REST APIs, authentication, and authorization mechanisms (OAuth2, OIDC, JWT).
• Experience implementing and managing SAST, DAST, Software Composition Analysis (SCA), API security, and penetration testing programs.
• Experience automating security controls within CI/CD pipelines and software delivery processes.
• Strong knowledge of secure software engineering practices and secure-by-design principles.
• Experience with .NET, Angular, JavaScript, TypeScript, and modern web application architectures.
• Ability to identify strategic security improvements beyond vulnerability remediation.
• Strong stakeholder management skills, influencing development teams, architects, and security functions.
• Highly motivated, enthusiastic, and capable of working independently and collaboratively.
• Exceptional analytical and problem-solving skills with attention to detail and a business-focused approach.
• Strong interpersonal skills to influence technical decisions and communicate effectively.
• Creativity and resourcefulness in presenting solutions to complex security challenges.

• Own and continuously improve the application security posture of internally developed solutions throughout the software development lifecycle (SDLC).
• Monitor, assess, prioritise, and manage application security vulnerabilities from penetration testing, SAST, DAST, dependency scanning, bug bounty programs, and other security assessments, ensuring remediation within SLAs.
• Triage security findings to determine business risk, remediation requirements, and false positives with clear technical justification.
• Design, recommend, and implement scalable security controls and automation to reduce recurring vulnerabilities and improve remediation efficiency.
• Drive shift-left security by integrating automated security testing, policy enforcement, and secure development practices into CI/CD pipelines and engineering workflows.
• Identify vulnerability patterns and implement preventative controls, secure frameworks, coding standards, and developer guardrails.
• Serve as primary liaison with external penetration testing providers to ensure actionable and risk-based security assessments.
• Partner with Group Security teams to maintain vulnerability records, agree risk ratings, and resolve remediation disputes.
• Provide expert guidance on securing modern web applications, APIs, authentication mechanisms, and cloud-native architectures, focusing on .NET and Angular.
• Act as Application Security subject matter expert promoting secure design principles and security-by-default practices in solution delivery.
• Maintain and enhance secure development standards, policies, and engineering processes aligned with OWASP, NIST, and industry best practices.
• Monitor emerging threats, OWASP Top 10 trends, attack techniques, and security tooling innovations.
• Deliver security awareness and secure coding guidance to developers, leads, architects, and delivery teams.
• Provide updates on security posture, vulnerabilities, remediation performance, and risk reduction initiatives to governance forums and steering groups.

Wszystkie informacje o przetwarzaniu danych osobowych w tej rekrutacji znajdziesz w formularzu aplikacyjnym, po kliknięciu w przycisk "Aplikuj Teraz".