Job Search

Application Security Engineer

Reports to

Business Information Security Officer (BISO)

Role Summary

We are seeking a hands-on Application Security Engineer to strengthen the security of software products, platforms, APIs, cloud services, and supporting development practices. The role embeds security throughout the software development lifecycle by partnering with product, architecture, engineering, and platform teams to prevent, identify, and remediate vulnerabilities early.

The successful candidate combines strong software engineering capability with practical application security expertise and enables development teams through automation, reusable patterns, coaching, and risk-based guidance rather than acting as a late-stage approval gate. The role supports a secure-by-design approach in which software producers take ownership of customer security outcomes.

Responsibilities

Embed application security requirements and activities across requirements, architecture, design, development, testing, release, and operations.Facilitate threat modeling and security design reviews for applications, APIs, integrations, cloud-native services, and AI-enabled capabilities.Perform secure code reviews and targeted manual security testing; reproduce vulnerabilities and provide actionable remediation guidance.Engineer, integrate, and continuously improve SAST, DAST, software composition analysis, secrets detection, and related controls in CI/CD workflows.Define and maintain secure coding standards, reusable security patterns, reference implementations, and developer guidance.Partner with Solution Architects, Security Architects, and platform teams to address authentication, authorization, data protection, cryptography, logging, and secure configuration.Triage technically complex application and dependency findings, validate exploitability, and advise on severity, business impact, and remediation options.Support development teams in correcting vulnerabilities and verify that fixes address root causes without introducing regressions.Coordinate application penetration tests and security assessments; translate findings into sustainable engineering improvements.Contribute application security evidence to product risk reviews, audits, and regulatory readiness, including expectations arising from the Cyber Resilience Act.Engineer security for desktop clients and hybrid desktop-to-cloud products, including secure update mechanisms, code signing, release integrity, and artifact provenance.Implement SBOM generation and dependency governance workflows that support software component visibility, vulnerability response, and regulatory readiness.Define and verify security requirements for engineering calculation, configuration, and specification workflows, protecting the integrity and correctness of customer outcomes and project data.Support security incident analysis where application behavior, source code, APIs, or software dependencies are involved.Support coordinated vulnerability disclosure and product security response by validating reported issues and helping define sustainable corrective actions.Establish and coach a network of security champions; deliver practical training and improve developer self-service capabilities.Track application security coverage, recurring weakness patterns, remediation performance, and effectiveness of preventive controls.Collaborate with cybersecurity, application security, architecture, DevSecOps, product teams, and enterprise security functions.

Required Qualifications

Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or a related field, or equivalent practical experience.Several years of hands-on experience in software engineering, application security, product security, or DevSecOps.Strong programming and scripting skills in at least one language commonly used in modern software development.Demonstrated experience with threat modeling, secure code review, and security testing of web applications and APIs.Practical knowledge of common vulnerability classes, including the OWASP Top 10, authentication and authorization flaws, injection, insecure design, and software supply chain risks.Experience integrating and tuning SAST, DAST, SCA, and secrets scanning tools within CI/CD pipelines.Understanding of cloud-native architectures, containers, identity, encryption, logging, and secure configuration.Ability to investigate findings, assess exploitability, and communicate technically precise remediation guidance.Strong collaboration and coaching skills, with the ability to influence engineering teams without direct authority.Strong written and verbal communication skills in English.High level of integrity, ownership, and commitment to protecting customers and software assets.Experience working with global teams.Ability to travel internationally when required for key workshops, assessments, or team collaboration.Ability to collaborate effectively across global time zones with teams distributed across multiple continents.

Preferred Qualifications

Experience securing AWS-based, SaaS, microservices, mobile, or desktop applications.Knowledge of NIST Secure Software Development Framework, secure-by-design principles, and risk-driven software assurance using OWASP ASVS and SAMM.Experience applying OWASP ASVS at a risk-appropriate assurance level rather than treating every control as universally mandatory.Experience with tools such as Burp Suite, OWASP ZAP, Semgrep, SonarQube, Snyk, Checkmarx, GitHub Advanced Security, or equivalent.Knowledge of API security, OAuth 2.0, OpenID Connect, JWT, secrets management, and software bill of materials practices.Experience applying security to AI-enabled applications and modern software supply chains.Relevant certifications such as CSSLP, GIAC GWEB/GWAPT, OSWE, or equivalent.Familiarity with engineering or technical software environments is advantageous.

GCS is acting as an Employment Agency in relation to this vacancy.

Read less

Application Security Engineer

You'll join a centralised Application Security team responsible for managing the full lifecycle of security findings reported by customers, internal teams, and third‑party testers.

You'll triage real‑world vulnerability reports, reproduce issues in controlled environments, analyse platform‑level attack surfaces, and collaborate with engineering teams to validate fixes and guide remediation.

Day to Day Responsibilities

Validate vunerabilities, assess scope and impact, determine severity, and recommend remediation paths.vulnerabilities across web, API, and server-side components and privilege escalation.Produce clear, accurate security assessments suitable for both engineering teams and executive level.Partner with development teams on defect filing, patch validation, backport decisions, and fix completeness.Recreate customer scenarios in lab environments to verify reported vulnerabilities and confirm remediation.Review server-side and client-side code to trace attack vectors and validate security fixes.

Desired Experience

Relevant eperience in application security, penetration testing, bug bounty triage, or product security engineering.Strong working knowledge of OWASP Top 10 and modern attack classesAbility to read and trace JavaScript and Java codebases to identify vulnerabilities and validate fixes.Experience writing clear, technically accurate security reports for diverse audiences.Fluency in CVSS scoring, including rationale behind severity decisions.

GCS is acting as an Employment Business in relation to this vacancy.

Read less