Duco

Senior Application Security Engineer - Product Security & DevSecOps

Brak informacji o wynagrodzeniu

SeniorHybryda·WrocławFull-time

#470273·Dodano 14 dni temu·0

Źródło: Duco

Aplikuj teraz

Tech Stack / Keywords

Ox SecurityCI/CDSASTSCAAWS Python Java Ruby KubernetesOWASP Top 10

Podsumowanie oferty

Own application security across the software development lifecycle, embedding secure delivery from design and code through release pipelines. Manage the Ox Security ASPM platform, drive vulnerability remediation, and define threat modelling, security testing and CI/CD guardrails with Engineering teams.

Wymagania

Proven experience in an application security, product security or DevSecOps role, ideally within a SaaS environment.
Hands-on experience integrating security tooling into CI/CD pipelines.
A track record of converting SAST, SCA, secrets or ASPM findings into prioritised, remediated work rather than raw reporting.
Strong understanding of common vulnerability classes and the OWASP Top 10, with practical knowledge of how to remediate them.
Ability to read and review code in at least one core language: Java, Ruby or Python.
Experience facilitating threat modelling with engineering teams.
Working knowledge of AWS and infrastructure-as-code.
Proficiency in Python or a comparable scripting language for automation.
Credibility with developers, and ability to influence engineering teams and articulate risk in actionable terms.

Nice to have:

Hands-on experience with Ox Security or another ASPM platform.
Background in software engineering before moving into security.
Software supply chain security experience, such as SLSA, SBOMs or artefact signing.
Container and Kubernetes security experience, including image scanning and admission controls.
Experience with policy-as-code tooling.
Experience establishing a security champions programme.
Experience securing LLM or agentic AI capabilities, such as applying the OWASP Top 10 for LLM Applications.
Familiarity with financial services regulations and standards, such as DORA, ISO 27001 and SOC 2.
Relevant professional certifications, such as OSWE, GWAPT, CSSLP or AWS Certified Security – Specialty.

Obowiązki

Secure SDLC and pipeline security

Own security across the SDLC and CI/CD pipelines, embedding secure delivery as the default.
Build and maintain pipeline security guardrails, including SAST, SCA, secrets scanning, IaC and container image scanning, with gating policies agreed with Engineering.
Strengthen software supply chain security, including dependency hygiene, SBOMs and build provenance.
Define pre-deployment cloud guardrails through policy-as-code, in partnership with the Senior Security Engineer (Cloud & SecOps).

Vulnerability management and remediation

Own Ox Security as the ASPM platform, including policy tuning, noise reduction and prioritisation of findings based on reachability and exploitability.
Drive remediation with engineering teams, agree remediation SLAs with engineering leads and report on progress.
Scope and coordinate application penetration testing, tracking findings through to remediation.

Secure design and engineering enablement

Lead threat modelling for new features and significant architectural changes.
Conduct secure design reviews and review high-risk code changes.
Promote secure coding practices through practical guidance, training and a security champions network across Engineering.

Client assurance, reporting and threat awareness

Represent platform security in client security reviews and due diligence discussions, alongside the Head of Information Security.
Maintain and report application security metrics that inform risk reporting and key risk indicators (KRIs).
Support audits and client assurance activities with evidence of secure development and release practices.
Monitor emerging application and supply chain threats, including those affecting AI and agentic capabilities.

Benefity

Success Share bonus payments.
Private Medical Insurance – Enel Med.
Life Insurance.
Multisport Program.
Unlimited annual holiday.
Enhanced family leave.
Employee Assistance Programme.
4 volunteering days off.
Referral bonus for a successful hire from your recommendation.
Spot Rewards.
EAP Wellbee.

Premie

Opieka zdrowotna

Ubezpieczenie

Karta sportowa

Płatne święta

Płatny urlop

Duco

5 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz