Application security engineer

Timestamp Group brings together several leading Portuguese companies in IT solutions and services around the principles of excellence and knowledge sharing. We are committed to technological leadership, based on the quality of our service and technology solutions, supported by continuous training and certification.

• Protect the organization’s applications and products, ensuring that security is integrated at every stage of the development and operations lifecycle. Promote secure development practices, identify and manage vulnerabilities, and support technical teams in implementing solutions and mitigating security risks.
• Define and promote secure development best practices (Secure SDLC).
• Integrate security requirements and controls into the software development lifecycle.
• Participate in architecture reviews and conduct Threat Modeling sessions.
• Analyze and follow up on vulnerabilities identified through pentests, SAST, DAST, and dependency and container analysis tools.
• Support development teams in analyzing and fixing vulnerabilities.
• Coordinate penetration tests, including defining scope, monitoring suppliers, and validating results.
• Promote Secure Coding best practices, including through workshops, guidelines, and mentoring.
• Support the integration of security controls into CI/CD pipelines (DevSecOps).
• Define metrics and track the progress of application security maturity.

• Relevant education or experience in software development and application architecture.
• Professional experience in Application Security or roles related to secure development.
• Good knowledge of development in Java (Spring Boot) and/or C# (.NET).
• Knowledge of cloud platforms (AWS, Azure, or Google Cloud) and experience deploying applications.
• Knowledge of Linux and scripting.
• Knowledge of the main application security concepts, including:
• OWASP Top 10 and ASVS.
• Secure Coding and Threat Modeling.
• Authentication and authorization (OAuth2, OpenID Connect, and JWT).
• API Security.
• Cryptography and secrets management.
• Experience with security tools such as SonarQube, Checkmarx, Fortify, Veracode, Snyk, OWASP ZAP, Burp Suite, or Trivy.
• Knowledge of CI/CD and DevSecOps practices.
• Good communication skills and ability to collaborate with multidisciplinary teams.
• Ability to influence others and promote technical best practices.
• Analytical mindset and problem-solving skills.
• Ability to train, mentor, and share knowledge.
• Pragmatic approach to risk management and mitigation.
• A professional with a solid background in software development, able to understand code and application architecture and apply that knowledge to identifying, assessing, and mitigating security risks, working closely with development, architecture, and operations teams.

• Health insurance.
• Flexibility in the organizational routine.
• Training and certifications.
• Employee Assistance Program (in 5 areas, including psychology).
• Birthday and Long-Service gifts.
• Monthly Happy Hour.
• Benefits portal with attractive offers.