(Senior) Application Security Engineer

Sygnum Bank; Zürich; Hybrid; CHF 150.000 - 190.000; Vollzeit

Benefits dieser Stelle

Market salary + incentive scheme

Flexible/Work at home policies

Mentoring and Buddy programs

Sabbatical after 5 years

Zusammenfassung

Sygnum is expanding its security function and seeks an experienced application security engineer to own and advance secure-by-design practices across cloud-native platforms. You will embed security into CI/CD, evaluate AI-enabled services, and help design robust threat models in a dynamic, crypto-native banking environment.

You will collaborate with engineering, platform, and product teams to strengthen secure development, mentor teams, and drive secure cloud deployment patterns while aligning

Qualifikationen

• 5-7+ years of hands-on experience in application security or DevSecOps in modern engineering environments.
• Experience securing cloud-native architectures (AWS and Azure preferred).
• Deep understanding of Kubernetes security, containers, and IaC security.
• Experience reviewing Infrastructure-as-Code and performing secure code reviews across backend, web, and/or mobile applications.
• Practical knowledge of application security standards, e.g., OWASP Top 10 and API Top 10 in real-world systems.

Aufgaben

• Integrate and improve security controls within CI/CD pipelines including SAST, DAST, SCA, and IaC scanning to strengthen DevSecOps practices
• Configure, operate, and optimise application security tooling, ensuring findings are actionable and integrated into engineering workflows
• Partner with engineering, platform, and product teams to design and implement secure-by-design architectures, perform threat modelling and promote secure development practices
• Evaluate open-source dependencies and contribute to software supply chain security initiatives
• Assess and secure AI-enabled applications and services, including AI/LLM integrations, AI supply chain risks, model security controls, and secure deployment patterns
• Review and harden Infrastructure-as-Code implementations to enable secure cloud deployment patterns and reusable guardrails

Kenntnisse

Application security

DevSecOps

Cloud security

Kubernetes security

Threat modelling

Secure development

API security

AI security

Cryptography basics

Regulatory knowledge

Ausbildung

Bachelor's degree in Computer Science or related

Security certifications (CISSP/OSCP)

Tools

AWS

Azure

Kubernetes

IaC scanning

SAST/DAST

CI/CD tooling

Jobbeschreibung

Sygnum is a global digital asset banking group, founded on Swiss and Singapore heritage. We empower professional and institutional investors, banks, corporates and DLT foundations to invest in digital assets with complete trust. Our team enables this through our institutional-grade security, expert personal service and portfolio of regulated digital asset banking, asset management, tokenization and B2B services.

In Switzerland, Sygnum holds a banking licence and has CMS and Major Payment Institution Licences in Singapore. The group is also regulated in the established global financial hubs of Abu Dhabi and Luxembourg.

We believe that the future has heritage. Our crypto-native team of banking, investment and digital asset technology professionals are building a trusted gateway between the traditional and digital asset economies that we call Future Finance. To learn more about how Sygnum's mission and values are shaping this digital asset ecosystem, please visit sygnum.com and follow us on LinkedIn and X.

Our Values

A key pillar of our success are the Sygnum values that define and unite us a team. We proudly call them our SYGN values:

• S stands for the importance we hold in Seeking and seizing opportunities, and the way we take personal ownership for delivering results for our clients;
• Y represents the way we say Yes to maintaining the highest level of integrity and fairness in everything we do. Sygnumers always display confidence without attitude;
• G reminds us to always Grow and win together. We only succeed by supporting each other and challenging ourselves, and our team-mates, to reach for new heights;
• N is here for Nose for value because we are always looking to focus on what matters most to our clients, partners and team.

Sygnum has one of the most diverse teams in the industry. Diversity plays a central role in keeping our work culture open, our teams productive and energised, and our solutions at the forefront of the industry. In the spirit of our SYGN value to "grow and win together", we fully embrace an equal opportunity mindset in the way we onboard, develop and promote our team members.

About the role

This is a hands-on technical role for someone who can operate deeply across modern application security disciplines and cloud-native environments. You will contribute to application security across our platform, covering web, mobile, APIs, backend services, and cloud infrastructure, by embedding security into engineering processes, CI/CD pipelines, and runtime environments. Your main responsibilities include:

• Integrate and improve security controls within CI/CD pipelines including SAST, DAST, SCA, and IaC scanning to strengthen DevSecOps practices
• Configure, operate, and optimise application security tooling, ensuring findings are actionable and integrated into engineering workflows
• Partner with engineering, platform, and product teams to design and implement secure-by-design architectures, perform threat modelling and promote secure development practices
• Evaluate open-source dependencies and contribute to software supply chain security initiatives
• Assess and secure AI-enabled applications and services, including AI/LLM integrations, AI supply chain risks, model security controls, and secure deployment patterns
• Review and harden Infrastructure-as-Code implementations to enable secure cloud deployment patterns and reusable guardrails
• Assess the security design of smart contracts, blockchain integrations, and third-party Web3 services
• Partner with SOC and engineering teams to improve detection, alerting, and response capabilities for application-layer threats.

You are an experienced technical security expert who can demonstrate the following skills and experience:

• 5-7+ years of deep, hands-on experience in application security or DevSecOps in modern engineering environments
• Strong experience securing cloud-native architectures (AWS and Azure preferred)
• Deep understanding of Kubernetes security, containers, and IaC security
• Experience reviewing Infrastructure-as-Code and performing secure code reviews across backend, web, and/or mobile applications
• Practical knowledge of application security standards, e.g., OWASP Top 10 and API Top 10 in real-world systems
• Familiarity with runtime application security concepts including observability, detection engineering, and production security monitoring
• Strong understanding of API security concepts including authentication, authorisation, API gateways, and modern identity patterns
• Ability to work directly with engineers and influence design and implementation decisions
• Experience building AI agents and applying AI to automate security workflows
• Solid understanding of cryptography fundamentals and key management (KMS/HSM)
• Relevant education, certifications, or equivalent practical experience
• Experience with digital asset custody, web3, smart contract or transaction signing workflows
• Track record of owning or building an application security function
• Background in offensive security, red teaming, or bug bounty
• Experience with financial services regulatory requirements (FINMA, MAS, DORA)

Our Offer

Joining Sygnum means being part of a dynamic, global team that is building a trusted gateway between the traditional and digital asset economies. Working at Sygnum, you will experience our fast-paced, exciting work environment that embraces meritocracy and collaboration and open communication. Alongside our ambitious long-term mission, we also come together for reaching important milestones and annual crypto-industry anniversaries like Bitcoin Pizza Day, and regularly celebrate together at themed company events as part of our journey to shape Future Finance.

Sygnum offers a comprehensive package of benefits for all team members. They include:

• Attractive combination of market salaries and entrepreneurial incentive scheme
• Flexible/Work at home policies
• Professional development via Mentoring and Buddy programs
• One-month fully paid sabbatical after five years of continuous employment