Job description

Job Description

We are seeking an experienced Senior Application Security Engineer with a strong focus on DevSecOps and penetration testing. The successful candidate will embed security into our GitLab CI/CD pipelines, perform hands-on testing of web applications, APIs, and cloud infrastructure, and work closely with development teams to identify and fix vulnerabilities early in the software development lifecycle.

Key Responsibilities

• Design and embed security gates in GitLab CI/CD pipelines, including SAST, DAST, dependency scanning, and secret detection.

• Conduct hands-on penetration testing of web applications, APIs, and cloud infrastructure.

• Manage the vulnerability remediation lifecycle: triage, prioritization, tracking, and verification of fixes with application owners.

• Develop automation scripts (Python, Bash, or Go) for vulnerability scanning, orchestration, and reporting.

• Perform secure code reviews and threat modeling of new features and architecture changes in collaboration with development teams.

• Define and maintain secure coding standards, pipeline security policies, and security gate criteria.

• Provide security guidance and coaching to developers, promoting a shift-left, security-by-design culture.

• Prepare clear technical reports, risk ratings, and remediation recommendations for technical and management audiences.

• Track emerging threats, vulnerabilities, and tooling, and continuously improve application security practices.

Minimum Requirements

• Proven experience embedding security gates (SAST, DAST, secret detection) into GitLab CI/CD pipelines.

• Hands-on experience performing web application, API, and cloud infrastructure penetration testing, and managing remediation.

• Strong scripting skills (Python, Bash, or Go) to automate vulnerability scanning and reporting.

• Strong background in software development, with the ability to review code and discuss fixes with developers.

• Experience working closely with development teams on code review, threat modeling, and early-lifecycle vulnerability remediation.

Preferred / Additional Skills

• Security certifications such as OSCP or CEH (OSCP preferred).

• Experience with cloud security (AWS, Azure, or GCP) and container/Kubernetes security.

• Familiarity with Infrastructure-as-Code scanning and software composition analysis (SCA).

• Experience with common security tools such as Burp Suite, OWASP ZAP, and Semgrep or similar SAST tools.

• Exposure to Agile/Scrum delivery methodology.

Experience & Education

• Bachelor's degree in Computer Science, Information Security, or a related field.

• 5+ years of experience in application security, DevSecOps, or penetration testing.

Skills

5+ years of experience in application security, DevSecOps, or penetration testing.