Senior Application Security Engineer

REQUIREMENTS

• Minimum 10 years of experience across Application Security, S-SDLC/DevSecOps, or Software Engineering/Security Engineering.
• Proven track record driving AppSec programs in medium or large organizations within modern SDLC, cloud-native, and SaaS environments.
• Strong technical expertise in AppSec fundamentals: OWASP Top 10, API security, multi-tenant application security, threat modeling, and security architecture reviews.
• Hands-on DevSecOps experience: CI/CD pipeline security, SAST/DAST, SCA, secrets management, container/Kubernetes security, and IaC security (Terraform preferred).
• Strong understanding of software engineering practices, experience with modern development frameworks/APIs, and the ability to read and review production-grade code.
• Strong business and operational capabilities: project management, executive-level reporting, documentation practices, and prioritizing work based on business risk.
• Excellent communication, coordination, and interpersonal skills, with the ability to influence engineering teams without direct authority.
• High level of ownership, autonomy, maturity, and proactive problem-solving.

PREFERRED QUALIFICATIONS

• Penetration testing experience, red teaming, or an offensive security background.
• Experience leading vulnerability management programs, security automation, and scripting.
• Practical experience applying AI/ML tools in development and cybersecurity (e.g., ChatGPT, Claude, GitHub Copilot).
• Specialized experience with GitLab / GitHub Security features.
• Security certifications such as CSSLP, CISSP, OSCP, GIAC, or Azure/AWS certifications.

BENEFITS

• Competitive annual salary.
• Private health insurance and a flexible benefits plan, allowing you to tailor part of your compensation package to your personal needs.
• Annual bonus based on individual performance and company results.
• Flexible working hours.
• Remote work options.

ROLE OVERVIEW

Technosylva is seeking a highly experienced Senior Application Security Engineer to elevate and mature our Application Security (AppSec) program across a modern cloud-native software environment.

This role is not limited to technical execution. We are looking for a security professional who combines deep hands-on AppSec expertise with strong business, communication, coordination, and program execution skills. The ideal candidate will partner closely with Engineering, Product, Platform, Infrastructure, and Security leadership to drive scalable security improvements across the software development lifecycle (S-SDLC).

This position will play a key role in transforming AppSec from a primarily tooling-focused function into a strategic, measurable, and business-aligned security capability.

RESPONSABILITIES

• Lead the evolution of Technosylva's Application Security program and roadmap, defining and improving secure SDLC processes across all engineering teams.
• Establish scalable security-by-design practices integrated into development workflows, driving adoption of secure coding standards, threat modeling, and security architecture reviews.
• Build practical and measurable AppSec KPIs and reporting for leadership.
• Improve and optimize GitLab/GitHub security capabilities and integrations (SAST, DAST, dependency scanning, container scanning, secrets detection, and IaC security workflows).
• Work closely with DevOps and Engineering teams to embed security into CI/CD pipelines, defining risk-based security gates and exception processes while reducing developer friction.
• Partner directly with developers, architects, and technical leads to remediate vulnerabilities, translate security requirements into actionable tasks, and conduct code reviews.
• Establish mature application vulnerability management processes: improve triage, prioritization based on business risk, SLAs, tracking through closure, and executive reporting.
• Own and drive AppSec initiatives from planning through execution across cross-functional teams (Engineering, Infrastructure, Product, Security), producing clear documentation and implementation plans.
• Help improve security culture within engineering teams by delivering secure coding guidance, workshops, awareness sessions, and mentoring junior engineers.
• Act as a trusted advisor rather than only an enforcement function, adapting communication effectively for both technical and non-technical stakeholders.