Application Security Engineer

Dassault Systèmes; Vélizy-Villacoublay; Hybride; EUR 60 000 - 100 000; Plein temps

Résumé du poste

An innovative firm is seeking an Application Security Engineer to enhance its cybersecurity posture. This full-time role involves assessing and improving the Secure Software Development Lifecycle, implementing security measures, and collaborating with engineers to embed security best practices throughout the product lifecycle. The ideal candidate will have extensive experience in application and infrastructure security, particularly in cloud environments, and possess strong communication skills to drive security initiatives. Join a forward-thinking team dedicated to advancing security in software development and making a significant impact on the organization.

Qualifications

• 3+ years of hands-on experience in application and infrastructure security.
• Strong grasp of offensive security to anticipate risks from an adversary's perspective.

Responsabilités

• Lead security efforts to integrate security into the software development lifecycle.
• Conduct secure design reviews and manage vulnerability programs.

Connaissances

Application Security

Infrastructure Security

Cloud Security

Threat Modeling

Vulnerability Management

Secure Coding Practices

Offensive Security

Security Awareness Training

Outils

Security Tools

Description du poste

As an Application Security Engineer, you will play a key role in assessing our Secure Software Development Lifecycle maturity, defining a security roadmap, and driving the implementation and improvement of cybersecurity activities.

This is a full-time, permanent role based in the DELMIA R&D Lab in 's-Hertogenbosch, the Netherlands. We expect you to work inside this office for at least 3 days a week.

YOUR RESPONSIBILITIES :

1. Lead our “shift left” security efforts to build security into the software development lifecycle.
2. Conduct secure design reviews and threat modeling sessions. Identify and prioritize risks, attack surfaces, and vulnerabilities.
3. Be available to conduct security code reviews and advise developers on remediating vulnerabilities and following secure coding practices.
4. Take charge of our vulnerability management program. Triage and prioritize vulnerabilities from scans, audits, and bug bounty submissions. Track remediation and validate fixes.
5. Research and recommend security tools and technologies to strengthen defenses against emerging threats targeting machine learning systems.
6. Develop and document security policies, standards, and playbooks. Conduct security awareness training sessions for engineers.
7. Collaborate closely with product engineers and researchers to instill security best practices. Advocate for secure architecture, design, and development.
8. Be the main DELMIA Quintiq R&D contact for security-related subjects, such as answering questions related to our security development practices, tools, and processes.

YOUR QUALIFICATIONS :

1. Have 3+ years of hands-on experience in application and infrastructure security, including securing cloud-based and containerized environments.
2. Have empathy, collaboration skills, and a learning mindset to work cross-functionally with engineers of all levels towards building security into the product lifecycle.
3. Use creative and strategic thinking to reduce risks through secure design and simplicity, not just controls.
4. Possess broad security knowledge to connect dots across domains and identify holistic ways to lower the overall attack surface.
5. Ability to distill complex security concepts into clear actions and drive consensus without direct authority.
6. Proactive mindset to integrate security throughout the product lifecycle through activities like threat modeling, secure code review, and security education.
7. Strong grasp of offensive security to anticipate risks from an adversary's perspective, not just check compliance boxes.
8. Experience with modern application stacks, infrastructure, and security tools to implement pragmatic defenses.
9. Passionate about security fundamentals like least privilege, defense-in-depth, and eliminating complexity to enhance security through smart design.