application security engineer

Big Stars is an end-to-end product engineering company based in Belgrade, Serbia. It transforms outdated systems into high-performing engines, creates user-focused products, designs stable and secure environments, and builds complex technology products.

• Collaborate with other teams to achieve complex objectives;
• Design security architecture from cloud infrastructure to applications using secure-by-design principles;
• Collaborate with product managers, architects, and developers on security controls, platform ecosystems, and products;
• Prove security implementations within infrastructure and application deployment manifests and CI/CD pipelines;
• Define policies, controls, and capabilities to protect products and environments;
• Build and validate declarative threat model automation;
• Participate in engineering teams’ product planning cycles and committees;
• Oversee product security during the migration of products and services from data centers to public cloud environments such as AWS;
• Serve as a trusted cybersecurity advisor to product and application teams.

• At least 3 years of experience as an Application Security Engineer;
• Experience integrating security scanning and tooling into development pipelines;
• Experience analyzing and securing microservices and applications developed with JavaScript and TypeScript;
• Experience with CI/CD pipelines such as GitLab and Jenkins;
• Experience with infrastructure-as-code models such as Terraform, Helm, or CloudFormation;
• Hands-on development experience with Python and shell scripting;
• Strong understanding of supply chain security, software integrity, and secure software delivery;
• Experience with Docker and mesh technologies such as Istio;
• Experience with architecture and security reviews, threat modeling, and application risk;
• Experience working with Agile methodologies;
• Knowledge of privacy laws and regulations such as GDPR;
• Familiarity with industry regulations, frameworks, and practices such as PCI, ISO 27001, and NIST;
• Nice to have: in-depth experience architecting secure services on Kubernetes, extensive experience architecting secure services on AWS or on-premises data centers, security certifications such as CISSP, CISM, CCSK, CCSP, or CEH.

• 24 Vacation days annually;
• 6 Sick days without a medical certificate;
• Premium health insurance with coverage up to 5,000 EUR annually;
• Special occasion gifts for birthdays, weddings, and newborns;
• Learning and Development budget for conferences, courses, and certifications;
• Corporate events, international parties, team buildings, and activities;
• Career growth opportunities in a fast-growing company;
• Relocation package for international candidates;
• Sports package with FitPass membership;
• Serbian and English language classes covered by the company.