Senior Application Security Analyst

Full-time position (40 hours per week) in Europe.

Join a team contributing to the continuous improvement of application security practices in a dynamic, growing environment. Partner with developers, DevOps, system administrators, architects, and cybersecurity stakeholders to drive change and achieve cross-functional outcomes.

Overlap until 19:00 CEST.

Requirements

• Degree in computer science, 5 to 10+ years of experience, or an equivalent combination of training and experience.
• Security certification(s) required: CISSP, CSSLP, CEH, OSCP, GIAC, or demonstrated equivalent security knowledge and experience.
• Cloud or vendor-specific security certification(s), or demonstrated equivalent security knowledge and experience.
• Hands-on security experience implementing and supporting CI/CD pipelines, secret management solutions, image management, service mesh, WAF, cloud firewall and rule management, Kubernetes, container security, API gateway, cloud workload protection and posture, IaC, compliance as code, and GitOps.
• Hands-on experience with security testing, secure coding, training, secure product design, security automation, and incident response.
• Strong understanding of APIs, web services, modern software architecture, secure design, and threat-modeling methodologies.
• Scripting knowledge: Python, Bash.
• Knowledge of at least one or two development languages: Java, Node.js, C#, .NET.
• Knowledge of information security risks, frameworks, regulatory requirements, and industry best practices.
• Familiarity with network protocols and cloud networking, with a good understanding of the network threat landscape.
• Expert problem-solving, advanced interpersonal and communication, autonomous working, and time-management skills.
• Broad application-security knowledge, including application development, testing methodologies, security testing, secure coding, training, and secure product design.
• Broad cloud-security knowledge, including cloud deployment, automation, secure configuration and policies, and cloud security services.

Responsibilities

• Identify threats, recommend controls, and support business goals through broad information and application security expertise.
• Define, implement, and continuously improve security controls and baseline configurations.
• Assess control effectiveness across CI/CD pipelines and application platforms, including desktop, web, mobile, containers, and COTS.
• Own and evolve application and cloud security services, including tool selection, onboarding, configuration, operations, and testing.
• Advise on application security across architecture, engineering, and secure coding practices.
• Drive security automation and repeatable guardrails throughout the SDLC.
• Lead threat modeling and secure design activities for key initiatives.
• Partner with engineering, product, platform, architecture, and business teams to design and implement security features.
• Act as a subject matter expert for application and cloud security; make decisions on complex issues aligned with best practices.
• Create training materials, guidelines, secure patterns, and documentation.
• Coordinate training sessions, knowledge-sharing forums, and AppSec/CloudSec communities of practice.
• Mentor stakeholders on web, mobile, API, and cloud security; advise developer squads on vulnerabilities, secure design, and best practices.
• Educate teams on application and cloud risks, secure configuration, secure coding, and core security concepts.

Benefits

• US and EU projects based on advanced technologies.
• Competitive compensation based on skills and experience.
• Regular performance appraisals to support growth.
• Flexible workspace: remote or office.
• Bonuses for article writing, public talks, and other activities.
• Generous time off, including vacation, national holidays, sick leave, and family days.
• Personalized learning programs tailored to interests and skill development.
• Free tech webinars and meetups.
• Regular corporate online activities.
• Friendly, supportive team community.