Application Security Engineer

Altery; España; Hybrid; EUR 60,000 - 80,000; Full time

Benefits offered by this job

Flexible working hours

Core hours 9am-2pm UK time

Wellbeing support

Career growth opportunities

Global team

Job summary

Altery is seeking an Application Security Engineer to join its Cybersecurity team. You will build security into our web, API and mobile products, triaging findings from scanners and Bug Bounty, validating exploits, and helping engineers fix root causes before they reach customers.

You’ll embed SAST, DAST, SCA, and secret detection into CI/CD pipelines, conduct threat modelling, and strengthen our software supply chain. Fluent English is required for technical communication.

Qualifications

• 2+ years in application security engineering or similar role.
• Experience with web and mobile architectures, microservices, containers, CI/CD.
• Knowledge of secure SDLC and security testing methods.

Responsibilities

• Own security findings end to end: triage, validate and assess exploitability.
• Collaborate with developers to fix root causes and reduce risk.
• Integrate SAST/DAST/SCA and secret detection into CI/CD pipelines.
• Review architectures via threat modelling for new features.
• Strengthen software supply chain security and secrets rotation.
• Report monthly on application security posture.

Skills

AppSec Engineer

CI/CD Security

SAST

DAST

SCA

Bug Bounty

Threat Modelling

Secrets management

AWS security

ELK security

Automation scripting

Networking basics

English fluency

Job description

At Altery, we're building products that make finance feel seamless in a fragmented world. We build the technology that helps businesses and people move money across borders, currencies and digital assets, without the friction.

Behind every simple payment is a complex system, and a team that makes it work. We look for people who enjoy solving difficult problems, challenge each other with respect and care about doing great work.

We're now looking for an Application Security Engineer to join our Cybersecurity team. You'll make security part of how we build: finding real vulnerabilities in our web, API and mobile products and helping our engineers fix them before they reach customers.

What you'll bring to us

Must-haves

• 2+ years as an Application Security Engineer, with a strong understanding of modern web and mobile architecture, including microservices, containers, CI/CD and Secure SDLC principles.
• Hands-on experience building security checks into CI/CD pipelines: SAST, DAST, SCA, secret detection, container image scanning and security gates.
• Experience triaging findings from scanners and Bug Bounty, including manual validation, exploitability assessment, PoCs and communicating fixes to developers.
• Mobile application security testing based on OWASP MASVS/MASTG, including root and emulator detection, SSL pinning and anti-tampering.
• Experience in threat modelling and security review of architecture decisions and new features.
• Practical knowledge of software supply chain security and secrets management.
• Fluent English for technical reading, writing and communication.

Nice to have

• A fintech or payments background, including PSD2/SCA, cardholder data and PIN protection, and awareness of PCI DSS.
• Experience running or supporting a Bug Bounty programme, or taking part in one as a researcher.
• Experience using AI and LLM tools in AppSec, such as AI-assisted triage or AI pentest frameworks, and an understanding of AI integration risks.
• Cloud security basics, ideally on AWS.
• Experience with ELK, including security dashboards and metrics and detecting sensitive data in logs.
• Experience with Security Champions programmes, secure coding checklists or developer training.
• Scripting skills for automation and data analysis, and a good understanding of TCP/IP and core network and web protocols.

How you work

• You take ownership: you follow a finding through to a real fix rather than just raising a ticket.
• You collaborate: you work with engineers as partners, share early and help them build security into their own work.
• You're curious: you like to learn, experiment and use AI and automation thoughtfully.

What you'll be doing at Altery

• Own security findings end to end: triage results from scanners and our Bug Bounty programme, validate them manually, assess exploitability and build proofs of concept.
• Work with development teams to explain vulnerabilities clearly and help them fix the root cause, not just the symptom.
• Help build and improve our Secure SDLC, embedding SAST, DAST, SCA, secret detection, container image scanning and security gates into our CI/CD pipelines.
• Review application architectures and new features through threat modelling, and turn the results into clear security requirements for our products.
• Test our web, API and mobile applications dynamically, with a focus on the business logic flaws that scanners miss.
• Strengthen our software supply chain and secrets management, from dependency control to secrets detection and rotation.
• Report monthly on our application security posture, so the team can see what's improving and where to focus next.

How we value you

Here's what you can expect when you join Altery:

• Competitive compensation that rewards your contribution.
• Flexible working. Wherever you are, you work your local hours with flexibility, and we all come together during core hours, 9am-2pm UK time. Near a hub? We'd love to see you from time to time, but we care more about outcomes than office hours.
• Wellbeing support, including additional sick leave when you need it.
• Opportunities to grow your career by taking ownership, expanding your skills and making a real impact.
• A team that has your back: we're team players, not solo stars. People here are quick to help and ready to collaborate.
• Ownership from day one: you're trusted to make decisions, try new things and lead from wherever you are.
• Built by a global team: our team spans countries, cultures and time zones, and those different perspectives help us build for customers around the world.
• High standards, continuous growth: you'll be encouraged to learn, challenge assumptions and help raise the bar.
• Resilient by design: we're a startup, so we don't expect easy days, we expect progress. When challenges come, you'll never face them alone.

We celebrate our diversity: its power strengthens our team. We welcome applications from everyone, whatever your background, and we hire based on skills, experience and the difference you can make.

We treat your personal data with care and use it only for recruitment. Applications are processed through our hiring platform, HiBob. To find out how your data is handled, read the Bob Hiring privacy notice.