Application Security Engineer (F/M)
160 - 215 PLN/ godz.B2B
#460256·Dodano 4 dni temu·2
Źródło: justjoin.itTech Stack / Keywords
Podsumowanie oferty
As an Application Security Engineer, you will strengthen the security of internally developed solutions by embedding security throughout the software development lifecycle. You will automate security controls and integrate security testing into CI/CD workflows, with a focus on .NET and Angular applications.
Wymagania
- Strong practical knowledge of the OWASP Top 10 and common web application attack vectors.
- Deep understanding of securing modern web applications, REST APIs, authentication and authorisation mechanisms (OAuth2, OIDC, JWT).
- Experience implementing and managing SAST, DAST, SCA, API security and penetration testing programmes.
- Experience automating security controls within CI/CD pipelines and software delivery processes.
- Strong knowledge of secure software engineering practices and secure-by-design principles.
- Experience with .NET, Angular, JavaScript, TypeScript and modern web application architectures.
- Ability to identify strategic security improvements beyond vulnerability remediation.
- Strong stakeholder management skills and ability to influence development teams, architects and security functions.
- Ability to work independently and collaboratively in a team-oriented environment.
- Strong analytical and problem-solving skills, attention to detail and a business-focused approach.
- Strong interpersonal skills and ability to influence technical decisions and communicate effectively in a fast-paced environment.
- Creativity and resourcefulness in presenting solutions to complex security challenges.
Obowiązki
- Own and continuously improve application security for internally developed solutions, embedding security throughout the software development lifecycle.
- Monitor, assess, prioritise and manage vulnerabilities from penetration testing, SAST, DAST, dependency scanning, bug bounty programmes and other assessments; ensure remediation within agreed SLAs.
- Triage security findings, assess business risk, determine remediation requirements and false positives, and document technical justifications.
- Design, recommend and implement scalable security controls and automation to reduce recurring vulnerabilities and manual work.
- Integrate automated security testing, policy enforcement and secure development practices into CI/CD pipelines and engineering workflows.
- Identify recurring vulnerability patterns and implement preventative controls, secure frameworks, coding standards and developer guardrails.
- Liaise with external penetration testing providers and ensure assessments are timely and findings are actionable, risk-based and aligned with business priorities.
- Partner with Group Security teams to maintain a single source of truth for vulnerabilities, agree risk ratings and resolve disputes about remediation requirements or false positives.
- Advise on securing web applications, APIs, authentication mechanisms and cloud-native architectures, particularly .NET and Angular solutions.
- Promote secure design principles and security-by-default practices across the Solution Delivery organisation.
- Maintain secure development standards, application security policies and security engineering processes aligned with OWASP, NIST and industry practices.
- Monitor emerging threats, OWASP Top 10 trends, attack techniques and security tooling innovations.
- Deliver security awareness and secure coding guidance to developers, technical leads, architects and delivery teams.
- Report on application security posture, vulnerability trends, remediation performance and risk reduction initiatives to governance forums and steering groups.
Benefity
- Opportunity to influence technological solutions and product direction in an international financial organisation.
- Ambitious projects with a high degree of autonomy and responsibility.
- Stable, long-term assignment.
- Flexible working hours.
Elastyczne godziny
AXA IT Solutions
4 aktywne oferty