Application Security Engineer

Quick Facts

• Role: Application Security Engineer

• Focus: application security across the full lifecycle (design → development → deployment → operations) and AI/LLM-related security

Description

Own and improve security controls across the SDLC, including CI/CD scanning and application/API assessments. Define secure coding and security requirements, lead threat modeling, and manage remediation via agreed SLAs. Evaluate AI tools and LLM/AI usage (e.g., prompt injection and data leakage) and implement cloud and WAF protections (Azure + Sentinel detections) while supporting incident response.

Responsibilities

• Set up and maintain CI/CD security controls (SAST, SCA, secret scanning, container image scanning)

• Define secure coding standards and security requirements; run threat modeling with development teams

• Assess applications and APIs pre-deployment using OWASP ASVS and API Security Top 10

• Run DAST, coordinate penetration tests, and drive findings to remediation within an SLA

• Manage an application vulnerability backlog; evaluate impact of vulnerable libraries/frameworks and report risk status

• Support developers with findings reviews, workshops, and a security champions program

• Evaluate AI tools/connectors and internal AI use cases, focusing on prompt injection, data leakage, agent permissions, and model risks

• Set rules for safe LLM API usage, logging, agent boundaries, and resilience tests

• Own WAF security rules for Azure Front Door / Application Gateway, tuning blocks and exceptions

• Check security configuration for Azure App Service, AKS/containers, API Management, Key Vault, Managed Identity, and RBAC

• Integrate application and WAF logs into Microsoft Sentinel and define attack detections

• Provide technical analysis during application incidents and coordinate fixes with responsible teams

Requirements

• At least 5 years of experience in application security, DevSecOps, or security-focused development

• Practical experience with SAST/SCA/DAST tools in CI/CD (e.g., SonarQube, Semgrep, Snyk, Dependabot, OWASP ZAP, Burp)

• Ability to write and tune WAF rules and handle false positives

• Knowledge of Azure application services: App Service, AKS/containers, API Management, Key Vault, identity, RBAC

• Experience with Microsoft Sentinel or another SIEM for application logs and detections

• Practical experience with LLM/AI in applications and their risks (or strong motivation to become an expert)

Benefits

• Work with measurable impact on important investment and strategic decisions

• Open team culture to share ideas and learn from experienced colleagues

• Unlimited vacation with 4 sick days

• Meal allowance

• Phone allowance