Application Security Engineer

About the role

We are hiring an Application Security Engineer for a leading European technology group, through Shakers. The role suits someone with a software development background who moved into application security, acting as a bridge between development, architecture, operations and corporate security.

What you will do

• Define and promote secure development practices, run threat modelling sessions and take part in architecture reviews.
• Support the implementation of authentication, authorisation and data protection mechanisms.
• Analyse, classify and prioritise risks coming from pentests, vulnerability assessments, SAST, DAST, dependency scanning and container scanning, and support engineering teams through remediation within SLA.
• Scope external pentests with vendors, validate findings, integrate automated security controls into CI/CD pipelines and define security metrics.
• Deliver Secure Coding workshops on the OWASP Top 10, write technical guidelines and help run a Security Champions network.

What you need

• Senior profile.
• Solid hands-on development experience in Java (Spring Boot, REST APIs, Maven) and/or C# .NET (.NET Core, ASP.NET). Frontend knowledge in Angular is valued.
• Mandatory cloud knowledge with real deployment experience, preferably AWS and/or Azure. GCP is considered transferable. Plus Linux and shell scripting.
• Practical command of OWASP Top 10 and ASVS, threat modelling, OAuth2/OIDC/JWT, API security, applied cryptography and secrets management.
• Experience with tooling such as SonarQube, Checkmarx, Fortify, Snyk, Burp Suite, Trivy, OWASP ZAP and Dependabot.
• Strong analytical skills, a pragmatic approach to risk, excellent communication and the ability to influence without hierarchical authority.
• Fluent English.

Practical details

Full time, long term. Hybrid, 2 days per week on site at Lagoas Park, Lisbon.