Application Security Engineer

XpertDirect; München; On-site; EUR 75,000 - 105,000; Full time

Job summary

XpertDirect in Munich is seeking an Application Security Engineer to strengthen security across modern applications, APIs, and software development workflows.

You will work at the intersection of CyberSecurity and Software Engineering, identifying vulnerabilities, improving secure development practices, and building automated security controls to help engineering teams deliver reliable, secure software.

Qualifications

• 3+ years in Application Security, Product Security, Software Security, or a similar role.
• Experience with Application and API Security.
• Python or similar scripting experience.
• CI/CD security integration.
• Knowledge of OWASP Top 10 and common vulnerabilities.
• Experience working directly with software engineering teams.

Skills

Application Security

Product Security

Software Security

Python scripting

CI/CD security

OWASP Top 10

Tools

Burp Suite

OWASP ZAP

Semgrep

SonarQube

Checkmarx

SCA

GitHub Actions

GitLab CI

API penetration testing

JWT security

Software supply-chain security

Infrastructure as Code security

DevSecOps

SaaS security

Job description

Developer Software | CyberSecurity | Application Security | Product Security | DevSecOps

Our client, a growing Developer Software company based in Munich, is looking for an Application Security Engineer to strengthen security across modern applications, APIs, and software development workflows.

You'll work at the intersection of CyberSecurity and Software Engineering, identifying vulnerabilities, improving secure development practices, and building automated security controls that help engineering teams deliver reliable, secure software.

Core Skills

• 3+ years in Application Security, Product Security, Software Security, or a similar role
• Application and API Security
• Python or similar scripting experience
• CI/CD security integration
• OWASP Top 10 and common application vulnerabilities
• Experience working directly with software engineering teams

Nice to Have

• Burp Suite / OWASP ZAP
• Semgrep / SonarQube / Checkmarx
• Software Composition Analysis (SCA)
• GitHub Actions / GitLab CI
• API penetration testing
• JWT / session security
• Software supply-chain security
• Infrastructure as Code security
• DevSecOps practices
• Experience securing SaaS or developer-facing products