Senior App Security Engineer — Hands-On, Secure-by-Default

Treatwell; España; Remote; EUR 90,000 - 120,000; Full time

Benefits offered by this job

28 days holiday

Monthly €40 Treatwell vouchers

Mental health support

Market-specific benefits

Job summary

Treatwell is seeking a Senior Application Security Engineer to own application security across Product Engineering and to lead the security tooling strategy. You will work hands-on with Java, Spring Boot, Ruby on Rails, TypeScript frontends, and native mobile apps, integrating SAST, DefectDojo, and related workflows across GitLab CI, ArgoCD, and GitHub Actions on AWS/Kubernetes.

You will drive threat modelling, ensure secure defaults, triage findings, and present the security posture to senior

Qualifications

• Written production code in Java, Ruby or TypeScript.
• Familiar with OWASP ASVS and Top 10.
• Integrated SAST, dependency scanning or secrets detection into CI pipelines.
• Experience with vulnerability management platforms.
• Knowledge of AWS and Kubernetes.

Responsibilities

• Own application security across Product Engineering.
• Lead security tooling in pipelines (SAST, DefectDojo).
• Run threat modelling with teams.
• Triaging findings and tracking to closure in DefectDojo.
• Present security posture to CTO and VP of Engineering.
• Coordinate security vendor relationships.

Skills

Java

Ruby

TypeScript

CI pipelines

Tools

GitLab CI

GitHub Actions

DefectDojo

SAST

Kubernetes

AWS

Datadog

Job description

Treatwell is seeking a Senior Application Security Engineer to own application security across Product Engineering and to lead the security tooling strategy. You will work hands-on with Java, Spring Boot, Ruby on Rails, TypeScript frontends, and native mobile apps, integrating SAST, DefectDojo, and related workflows across GitLab CI, ArgoCD, and GitHub Actions on AWS/Kubernetes.

You will drive threat modelling, ensure secure defaults, triage findings, and present the security posture to senior