Senior Application Security Engineer

nineDots.io; Ireland; Remote; EUR 95,000 - 130,000; Full time

Benefits offered by this job

Equity

Health cover

Learning budget

Job summary

nineDots.io is seeking a Senior Application Security Engineer to help secure a software supply chain platform across Ireland and the UK. You’ll review architecture, code and designs, and ship fixes that prevent cross‑tenant and API abuse.

You’ll work inside an engineering team, applying Python tooling and AWS knowledge while evaluating which vulnerabilities are exploitable and prioritizing fixes. Remote‑first with equity, health cover and a learning budget.

Qualifications

• Strong Python, AWS skills, and reviewing real applications are essential.
• Go, Rust or TypeScript are useful skills for this role.
• Experience shaping security in software engineering teams is valued.

Responsibilities

• Threat modelling APIs, identity flows and distributed services.
• Identify weaknesses in authorization, secrets handling and tenant isolation.
• Build Python tooling and reusable security controls.
• Prioritize fixes by impact and exploitability.

Skills

Python

AWS

Code review

Security mindset

Education

Bachelor's degree in CS or equivalent

Tools

Go

TypeScript

Rust

CI/CD

Job description

The interesting security bugs live between services.

An API trusts the wrong token. A worker crosses a tenant boundary. A build pulls in something it shouldn’t.

If you enjoy following those problems through the code and working out the fix, this could be your kind of role.

Senior Application Security Engineer

Remote-first | Ireland / UK | Equity

You’ll join a software supply chain company whose platform controls how customers store, trust and distribute the packages their software depends on.

You’ll sit inside an engineering team, involved while designs are taking shape. Review the architecture, challenge the assumptions, get into the code and help ship the fix.

There’s plenty to get stuck into:

• Threat modelling APIs, identity flows and distributed services.
• Finding weaknesses in authorisation, secrets handling and tenant isolation.
• Building Python tooling and reusable security controls.
• Working out which vulnerabilities are actually exploitable and what needs fixing first.

You’ll also have room to shape how application security works across engineering as the team grows.

You probably started in software engineering and found yourself increasingly drawn to security. Or you’ve worked in AppSec for years and still enjoy writing code.

Either way, strong Python, practical AWS knowledge and experience reviewing real applications matter here. Go, Rust or TypeScript would be useful too.

Experience with signing, provenance or software supply chain security is welcome. So is a serious interest in learning it.

Remote-first across Ireland and the UK, with travel for team sessions. Equity, health cover and a learning budget included. You’ll need existing right to work without sponsorship.