Senior Application Security Engineer (Spain Only)

Tecnosylva; León; Presencial; EUR 90.000 - 130.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Competitive salary

Private health insurance

Annual bonus

Flexible working hours

Remote work options

Descripción de la vacante

Technosylva in Spain is seeking a highly experienced Senior Application Security Engineer to elevate our AppSec program across a modern cloud-native software environment. This role blends hands-on security work with strategy, governance, and cross‑functional leadership.

You will partner with Engineering, Product, Platform, and Security leadership to transform AppSec into a measurable business capability, define secure SDLC processes, and drive secure coding, threat modeling, and security reviews.

Formación

• Minimum 10 years in AppSec/S-SDLC or related security engineering.
• Proven track record leading AppSec programs in modern SDLC, cloud-native environments.
• Hands-on DevSecOps experience with CI/CD security, SAST/DAST, SCA, secrets management, and IaC (Terraform).
• Strong communication, leadership, and ability to influence across tech and non-technical stakeholders.

Responsabilidades

• Lead the evolution of the AppSec program and roadmaps across engineering teams.
• Establish secure-by-design practices and secure coding standards.
• Build AppSec KPIs and reporting for leadership.
• Improve and optimize GitLab/GitHub security capabilities and integrations.
• Embed security into CI/CD pipelines with risk-based gates and reduced friction.
• Remediate vulnerabilities with engineers and conduct code reviews.
• Mature vulnerability management with triage, prioritization, SLAs, and reporting.
• Own AppSec initiatives from planning to execution with cross-functional teams.
• Improve security culture with coaching, workshops, and mentoring.

Descripción del empleo

Role Overview

Technosylva is seeking a highly experienced Senior Application Security Engineer to elevate and mature our Application Security (AppSec) program across a modern cloud-native software environment.

This role is not limited to technical execution. We are looking for a security professional who combines deep hands‑on AppSec expertise with strong business, communication, coordination, and program execution skills.

The ideal candidate will partner closely with Engineering, Product, Platform, Infrastructure, and Security leadership to drive scalable security improvements across the software development lifecycle (S-SDLC).

This position will play a key role in transforming AppSec from a primarily tooling‑focused function into a strategic, measurable, and business‑aligned security capability.

Responsabilities

• Lead the evolution of Technosylva's Application Security program and roadmap, defining and improving secure SDLC processes across all engineering teams.
• Establish scalable security‑by‑design practices integrated into development workflows, driving adoption of secure coding standards, threat modeling, and security architecture reviews.
• Build practical and measurable AppSec KPIs and reporting for leadership.
• Improve and optimize GitLab/GitHub security capabilities and integrations (SAST, DAST, dependency scanning, container scanning, secrets detection, and IaC security workflows).
• Work closely with DevOps and Engineering teams to embed security into CI/CD pipelines, defining risk‑based security gates and exception processes while reducing developer friction.
• Partner directly with developers, architects, and technical leads to remediate vulnerabilities, translate security requirements into actionable tasks, and conduct code reviews.
• Establish mature application vulnerability management processes: improve triage, prioritization based on business risk, SLAs, tracking through closure, and executive reporting.
• Own and drive AppSec initiatives from planning through execution across cross-functional teams (Engineering, Infrastructure, Product, Security), producing clear documentation and implementation plans.
• Help improve security culture within engineering teams by delivering secure coding guidance, workshops, awareness sessions, and mentoring junior engineers.
• Act as a trusted advisor rather than only an enforcement function, adapting communication effectively for both technical and non‑technical stakeholders.

Requirements

• Minimum 10 years of experience across Application Security, S-SDLC/DevSecOps, or Software Engineering/Security Engineering.
• Proven track record driving AppSec programs in medium or large organizations within modern SDLC, cloud‑native, and SaaS environments.
• Strong technical expertise in AppSec fundamentals: OWASP Top 10, API security, multi-tenant application security, threat modeling, and security architecture reviews.
• Hands‑on DevSecOps experience: CI/CD pipeline security, SAST/DAST, SCA, secrets management, container/Kubernetes security, and IaC security (Terraform preferred).
• Strong understanding of software engineering practices, experience with modern development frameworks/APIs, and the ability to read and review production‑grade code.
• Strong business and operational capabilities: project management, executive‑level reporting, documentation practices, and prioritizing work based on business risk.
• Excellent communication, coordination, and interpersonal skills, with the ability to influence engineering teams without direct authority.
• High level of ownership, autonomy, maturity, and proactive problem‑solving.

Preferred Qualifications

• Penetration testing experience, red teaming, or an offensive security background.
• Experience leading vulnerability management programs, security automation, and scripting.
• Practical experience applying AI/ML tools in development and cybersecurity (e.g., ChatGPT, Claude, GitHub Copilot).
• Specialized experience with GitLab / GitHub Security features.
• Security certifications such as CSSLP, CISSP, OSCP, GIAC, or Azure/AWS certifications.

Benefits

• Competitive annual salary.
• Private health insurance and a flexible benefits plan, allowing you to tailor part of your compensation package to your personal needs.
• Annual bonus based on individual performance and company results.
• Flexible working hours.
• Remote work options.

At Technosylva, we value diverse experiences and skills, and we understand that every career path is unique. We encourage anyone who believes they meet most of the requirements and is interested in growing and contributing in this role to apply.

DISCLAIMER

Final salary and benefits will depend on a variety of factors, including location, experience, training, qualifications, and market conditions.

EQUAL OPPORTUNITY STATEMENT

Technosylva is an Equal Opportunity Employer. We are committed to fostering an inclusive environment where diverse perspectives lead to better solutions.