Application security engineer in mobility

Devoteam Cyber Trust is the Cybersecurity specialist arm of the Devoteam Group. With our 800+ experts located across EMEA, we aim to establish cybersecurity as an enabler of business success rather than a gatekeeper. We leverage an end-to-end approach to Cyber Resilience, Applied Security, and Managed Security services to secure the tech journey of large and medium-sized companies from all sectors and industries.

• Define and promote Secure SDLC practices.
• Integrate security requirements into the development lifecycle.
• Participate in architecture reviews and solution designs.
• Conduct threat modeling sessions.
• Support teams in implementing authentication, authorization, and data protection mechanisms.
• Analyze results originating from Penetration Tests, Vulnerability Assessments, SAST / DAST, Dependency Scanning, Container Scanning.
• Classify and prioritize vulnerabilities.
• Provide technical support during remediation.
• Track remediation plans and their respective SLAs.
• Define test scope.
• Coordinate with external vendors.
• Validate findings.
• Ensure tracking and closure of recommendations.
• Conduct Secure Coding workshops.
• Promote OWASP Top 10 and secure development best practices.
• Support the creation of Security Champions within teams.
• Produce technical guidelines and standards.
• Integrate security controls into CI/CD pipelines.
• Promote automation of security checks.
• Define application security metrics and key performance indicators (KPIs).

• A professional with previous experience in software development and application architecture who has evolved into an Application Security role.
• Ability to interact with development, architecture, operations, and corporate security teams, acting simultaneously as a technical consultant, facilitator, and advocate for best practices.
• Capacity to understand code, architecture, and development processes, directly supporting the analysis and resolution of identified vulnerabilities.
• Solid experience in at least one of the following stacks: Java: Spring Boot; REST APIs; Maven; C# / .NET: .NET Framework / .NET Core; ASP.NET
• Linux, Shell Scripting, and basic system hardening.
• Required: Cloud knowledge with hands-on experience in production application deployments.
• Practical knowledge of: OWASP Top 10, OWASP ASVS, and Secure Coding best practices; Threat Modeling; Authentication & Authorization (including OAuth2, OpenID Connect, and JWT); API Security & Secure API Design; Applied Cryptography (TLS, key/certificate lifecycle, secure hashing); Secrets Management (secret stores, secret rotation, preventing secrets in code)
• Experience with tools such as: SonarQube, Checkmarx, Fortify, Veracode, Snyk, Dependabot, OWASP ZAP, Burp Suite, or Trivy
• Excellent communication skills.
• Ability to influence without hierarchical authority.
• Training and mentoring capability.
• Pragmatic approach to risk management.
• Ability to collaborate easily with development teams.
• Strong analytical mindset.
• Будет плюсом: Frontend (Optional / Desirable): Angular (JavaScript / TypeScript); Desirable: Knowledge of major cloud platforms (AWS and/or Azure preferred; Google Cloud or others are relevant and transferable)

• Условий в вакансии нет