Application Security Professional

This is a critical position within the security team, focusing on secure software development and cloud-native defense.

The successful candidate will be technically grounded, requiring direct engagement in application-layer matters and security reviews, while also contributing to cloud security automation, awareness initiatives, and secure engineering practices across the SDLC.

Key Responsibilities:

• Validate vulnerabilities and provide actionable remediation guidance aligned with business risk.
• Drive threat modeling sessions for critical systems and APIs.
• Design, implement, and oversee automated processes for securely updating application and code dependencies.
• Integrate security checks into CI/CD pipelines using tools like Semgrep, Snyk, Trivy, and Burp Suite.
• Contribute to runtime security initiatives, such as container/Kubernetes hardening, RASP, and eBPF-based detection.
• Build and maintain a security issues dashboard to track remediation status and metrics.
• Provide real-time support in cybersecurity incidents impacting applications or cloud infrastructure.
• Partner with the Cloud Security team on security automation tasks and monitoring improvements.
• Conduct proactive research on new threats, vulnerabilities, and attack techniques relevant to the architecture.
• Collaborate with the GRC team to develop and deliver internal security awareness initiatives.

Requirements:

• Fluent English with strong verbal and written skills.
• Strong problem-solving and analytical mindset.
• Excellent communication skills to convey security risks to technical and non-technical stakeholders.
• 3–5+ years of experience in application security, penetration testing roles, and/or secure code development.
• Hands-on experience with SAST, DAST, and SCA tools.
• Deep understanding of web, mobile, and API vulnerabilities.
• Proven expertise in performing code reviews or security assessments.
• Proficiency in at least one backend language and understanding of React/React Native front-ends.

Preferred Qualifications:

• Certifications such as OSCP, OSWE, GWAPT, CPTE, or CSSLP.
• AWS, GCP, or Azure Security Specialty certification.
• Familiarity with bug bounty triage and vulnerability management platforms.