App Security Engineer - Build Security Capabilities (Equity)

Transak; Österreich; Vor Ort; EUR 90.000 - 130.000; Vollzeit

Benefits dieser Stelle

Equity options

International team

Competitive package

Comprehensive benefits

Zusammenfassung

Transak is seeking its first dedicated application security hire to safeguard our widget, APIs, and user flows in a fast-moving fintech environment. You will own security end-to-end, building a capability from scratch rather than inheriting a mature programme.

Reporting to the CISO, you will embed security into the development lifecycle, run threat modelling, perform testing, and drive remediation across the software supply chain and external engagements.

Qualifikationen

• 5+ years as a security engineer focusing on application or product security.
• Strong understanding of web and API security including OWASP Top 10, authentication, authorization and session management.
• Hands-on experience with security testing tools such as Burp Suite, OWASP ZAP, Snyk and Aikido.
• Proficient in a modern language, ideally JavaScript/Node.js or Python.
• Experience integrating security tooling into CI/CD pipelines (GitLab CI, Jenkins, GitHub Actions).
• Experience with software composition analysis and SBOM concepts and supply chain security.
• Ability to manage vulnerability registers, ownership, SLAs and remediation processes.
• Threat modelling applied to real business flows and secure API architectures.
• Knowledge of cryptography, secrets management, IAM, and secure coding practices.
• Excellent communication skills to translate security concepts to engineers.
• Ability to build a capability from scratch rather than inheriting a mature programme.

Aufgaben

• Partner with engineering teams to embed security into the software development lifecycle from design to deployment.
• Conduct security code reviews, threat modelling sessions and architecture reviews for flows handling funds and identity data.
• Select, implement and tune SAST, DAST and SCA tools to identify vulnerabilities early in development.
• Build and maintain automated security testing in CI/CD with gating based on severity.
• Own the software supply chain with SBOM per service and provenance standards.
• Create and maintain a consolidated vulnerability register with triage and remediation tracking.
• Perform penetration testing and vulnerability assessments of web applications, APIs and mobile apps.
• Own external penetration testing programmes and scope engagements from threat models.
• Develop secure coding standards, reusable components and security training for engineers.
• Create a security champions programme to scale security beyond one person.
• Manage bug bounty programmes and coordinate with external researchers.
• Research emerging threats and integrate defensive measures into security architecture.
• Provide evidence of secure development and vulnerability management for DORA, MiCA, SOC 2 and ISO 27001.

Kenntnisse

Security engineering

Application security

OWASP Top 10

Secure coding

CI/CD integration

SBOM experience

Threat modelling

Cryptography basics

Strong communication

Tools

Burp Suite

OWASP ZAP

Snyk

Aikido

Jobbeschreibung

Transak is seeking its first dedicated application security hire to safeguard our widget, APIs, and user flows in a fast-moving fintech environment. You will own security end-to-end, building a capability from scratch rather than inheriting a mature programme.

Reporting to the CISO, you will embed security into the development lifecycle, run threat modelling, perform testing, and drive remediation across the software supply chain and external engagements.