Security engineer

We are looking for an Application Security Engineer to join the security area of a leading European group in the mobility and infrastructure sector, in a Java and/or .NET environment with AWS and/or Azure cloud. The organization wants to bring security to the start of the development cycle instead of treating it as a final step. Your role is to ensure teams design and write secure code by default, coordinate penetration tests and vulnerability assessments, and provide technical support for remediation through to the closure of recommendations.

• Define and promote Secure SDLC practices, integrating security requirements into the development cycle
• Participate in architecture reviews and lead threat modeling sessions
• Analyze results from penetration tests, vulnerability assessments, SAST, DAST, dependency scanning, and container scanning, classifying and prioritizing findings
• Support development teams with remediation and track correction plans and their SLAs
• Coordinate penetration tests with external providers: define scope, validate findings, and follow up through to closure
• Integrate security controls into CI/CD pipelines and automate checks
• Deliver Secure Coding workshops, promote OWASP Top 10, and create Security Champions within teams
• Define application security metrics and indicators

• Previous experience in software development and application architecture, with a move into Application Security
• Strong experience with at least one stack: Java (Spring Boot, REST APIs, Maven) or C# (.NET Framework / .NET Core, ASP.NET)
• Linux, shell scripting, and basic system hardening
• Cloud knowledge (required), with real-world application deployments, preferably AWS and/or Azure
• OWASP Top 10, OWASP ASVS, and Secure Coding best practices
• Threat modeling, authentication, and authorization (OAuth2, OpenID Connect, JWT)
• API security and secure API design
• Applied cryptography (TLS, key and certificate lifecycle, secure hashing)
• Secret management (secret stores, rotation, avoiding secrets in code)
• Experience with tools such as SonarQube, Checkmarx, Fortify, Veracode, Snyk, Dependabot, OWASP ZAP, Burp Suite, or Trivy
• Ability to influence without hierarchical authority and train development teams
• Будет плюсом: Angular frontend (JavaScript, TypeScript); Experience with other clouds (e.g., Google Cloud), considered relevant and transferable

• Long-term, full-time project with a direct impact on the application security maturity of the entire organization and cross-functional visibility with architecture, development, operations, and corporate security teams. This is not an auditing role; it is a building role.
• If you enjoy being close to the code while also changing the way teams work, this is the place for you.