Senior Windows AppSec Engineer, CI/CD & Bug Bounty

Malwarebytes; España; On-site; EUR 70,000 - 87,000; Full time

Benefits offered by this job

Medical/ dental/ vision

Referral bonus

Wellness programs

Time off policy

Meaningful work

Job summary

Malwarebytes is seeking a Senior Application Security Engineer focused on Windows applications. You will own the bug bounty program, secure desktop and cloud services, and collaborate with development teams to triage and remediate vulnerabilities.

You will work with SAST, DAST, and SCA tools, contribute to code reviews, and help shape secure development practices across the organization.

Qualifications

• Experience managing a bug bounty program and securing Windows desktop apps.
• Strong knowledge of SAST, DAST, and SCA tooling in CI/CD pipelines.
• Ability to communicate security topics clearly to technical and non‑technical audiences.
• Proficient in security code reviews and threat modeling.

Responsibilities

• Automate security workflows in CI/CD with SAST/DAST/SCA integrations.
• Lead external security reviews and coordinate pentests with vendors.
• Advise product teams on threat modeling and secure design reviews.
• Oversee bug bounty program and vulnerability triage with researchers.
• Validate and verify fixes with development teams and ensure risk remediation.
• Promote secure development practices across the organization.

Skills

Bug bounty program management

SAST/DAST/SCA tooling

GitHub Actions

Code review & security analysis

Desktop security (Windows)

Programming languages (C, C++, C#, or 

Tools

GitHub

GitHub Actions

GitHub Advanced Security

Job description

Malwarebytes is seeking a Senior Application Security Engineer focused on Windows applications. You will own the bug bounty program, secure desktop and cloud services, and collaborate with development teams to triage and remediate vulnerabilities.

You will work with SAST, DAST, and SCA tools, contribute to code reviews, and help shape secure development practices across the organization.