Application security engineer

We are hiring an Application Security Engineer for a leading European technology group, through Shakers. The role suits someone with a software development background who moved into application security, acting as a bridge between development, architecture, operations and corporate security.

• Define and promote secure development practices
• run threat modelling sessions
• take part in architecture reviews
• Support the implementation of authentication, authorisation and data protection mechanisms
• Analyse, classify and prioritise risks coming from pentests, vulnerability assessments, SAST, DAST, dependency scanning and container scanning
• support engineering teams through remediation within SLA
• Scope external pentests with vendors
• validate findings
• integrate automated security controls into CI/CD pipelines
• define security metrics
• Deliver Secure Coding workshops on the OWASP Top 10
• write technical guidelines
• help run a Security Champions network

• Senior profile
• Solid hands-on development experience in Java (Spring Boot, REST APIs, Maven) and/or C# .NET (.NET Core, ASP.NET)
• Mandatory cloud knowledge with real deployment experience, preferably AWS and/or Azure
• Plus Linux and shell scripting
• Practical command of OWASP Top 10 and ASVS, threat modelling, OAuth2/OIDC/JWT, API security, applied cryptography and secrets management
• Experience with tooling such as SonarQube, Checkmarx, Fortify, Snyk, Burp Suite, Trivy, OWASP ZAP and Dependabot
• Strong analytical skills
• a pragmatic approach to risk
• excellent communication
• the ability to influence without hierarchical authority
• Fluent English
• Будет плюсом: Frontend knowledge in Angular is valued; GCP is considered transferable

• Full time, long term
• Hybrid, 2 days per week on site at Lagoas Park, Lisbon