Security engineer

At Mootiva, we are recruiting a Security Engineer to join a project focused on application security, from design through to operation. We are looking for a professional with experience in software development and application architecture who has moved into the field of application security. You will work directly with development, architecture, and operations teams, supporting the identification and remediation of vulnerabilities and promoting secure development practices.

• Promote Secure SDLC practices and integrate security requirements into the development lifecycle;
• Participate in architecture reviews and threat modelling sessions;
• Analyze and prioritize vulnerabilities identified in pentests and using SAST, DAST, dependency analysis, and container analysis tools;
• Provide technical support to teams in remediating vulnerabilities and monitor remediation plans;
• Coordinate pentests with external vendors, validate results, and follow up on recommendations;
• Integrate and automate security controls in CI/CD pipelines;
• Run Secure Coding workshops, produce technical guidance, and support Security Champions initiatives;
• Define and monitor application security metrics.

• Previous experience in software development and application architecture, with a move into Application Security roles;
• Strong experience in Java (Spring Boot, REST APIs, and Maven) and/or C# (.NET Framework/.NET Core and ASP.NET);
• Knowledge of Linux, Shell Scripting, and basic hardening;
• Knowledge of cloud and experience deploying applications in real-world environments — mandatory requirement;
• Practical knowledge of OWASP Top 10, OWASP ASVS, Secure Coding, and Threat Modelling;
• Knowledge of API security, authentication, and authorization, including OAuth2, OpenID Connect, and JWT;
• Knowledge of applied cryptography, certificate management, and secrets management;
• Experience with some security tools, such as SonarQube, Checkmarx, Fortify, Veracode, Snyk, Dependabot, OWASP ZAP, Burp Suite, or Trivy;
• Ability to analyze code and directly support vulnerability remediation;
• Good communication and analytical skills, and the ability to train, guide, and engage teams in security best practices.
• Будет плюсом: Experience with AWS and/or Azure, with experience on other cloud platforms also considered relevant; Knowledge of Angular, JavaScript, and TypeScript

• Условий в вакансии нет