Remote Staff Application Security Engineer

Jobgether; Italia; On-site; EUR 90,000 - 150,000; Full time

Benefits offered by this job

Remote-friendly policies

Autonomy and impact

Advanced security tooling stack (Snyk,

Collaborative security culture

Job summary

Jobgether is partnering to hire a Staff Application Security Engineer based in Italy. You will establish and scale a secure SDLC, integrate SAST/DAST/SCA into CI/CD, and lead threat modeling across APIs, SDKs, and cloud systems.

The role emphasizes hands‑on engineering and AI‑assisted security tooling to advance product security at scale. You will collaborate with engineering teams and security leadership, guiding secure coding practices and building reusable security patterns while managing

Qualifications

• 8+ years of experience in software engineering and/or security engineering, including 5+ years focused on application security.
• Experience building or improving application security programs within a product engineering organization, with a strong emphasis on hands‑on implementation.
• Strong software engineering fundamentals and the ability to write production‑quality code in TypeScript, JavaScript, Go, Python, or a comparable language.
• Familiarity with modern web applications, APIs, software architectures, source code repositories, and CI/CD pipelines.
• Deep practical application security expertise, including OWASP Top 10 and related vulnerabilities, authentication and authorization design, API security, injection attacks, SSRF, cryptographic misuse, business‑logic flaws, and abuse scenarios.
• Ability to identify vulnerabilities through manual testing, explain their real‑world impact, and propose practical fixes that engineering teams can implement.
• Demonstrated experience leading threat modeling and architecture security reviews for complex systems and producing threat models that inform engineering decisions.
• Experience deploying, configuring, and tuning SAST, DAST, SCA, secrets detection, and related security tooling within CI/CD workflows.
• Practical experience using AI‑assisted security tools for code analysis, vulnerability triage, or automated remediation in real‑world environments.
• Regular use of AI agents in security work, with a clear understanding of their limitations, reliability, false‑positive risks, and appropriate level of autonomy.
• Experience owning vulnerability management processes, including triage, severity classification, remediation tracking, penetration testing follow‑up, and enforcement of remediation SLAs.
• Proven ability to influence engineering teams through technical credibility, effective collaboration, well‑designed tools, and actionable guidance rather than formal authority alone.
• Excellent written and verbal communication skills, including the ability to produce precise security findings and explain technical risks to engineers, leadership, and customer security teams.
• Strong analytical skills, sound technical judgment, and the ability to work independently on ambiguous, multi‑quarter initiatives.

Responsibilities

• Design and implement a secure software development lifecycle (SDLC), incorporating security requirements, design-time threat modeling, secure code reviews, and pre‑release testing into existing engineering workflows.
• Own and improve application security tooling, including static and dynamic application security testing (SAST/DAST), software composition analysis (SCA), dependency scanning, secrets detection, and container and infrastructure‑as‑code scanning.
• Integrate security tools into CI/CD pipelines, reduce false positives, establish clear vulnerability ownership and remediation service‑level agreements (SLAs), and ensure findings lead to meaningful action.
• Develop an AI‑first security engineering approach using AI‑assisted vulnerability triage, automated remediation, security review agents, and AI‑augmented testing, with evidence‑based controls governing what these tools can flag, block, or fix.
• Build reusable security patterns, hardened libraries, and secure defaults for authentication, authorization, input validation, secrets management, and cryptographic operations.
• Contribute directly to production codebases by implementing security fixes, developing security libraries, and building automation and CI integrations.
• Lead threat modeling and architecture security reviews for new products, features, and significant technical changes across APIs, web and mobile SDKs, dashboards, and data pipelines.
• Manage vulnerability identification, risk assessment, prioritization, and remediation for findings from security scanners, penetration tests, bug bounty reports, and customer disclosures.
• Conduct hands‑on security testing, including manual code review and exploitation testing for authentication and authorization weaknesses, API vulnerabilities, injection attacks, SSRF, business‑logic flaws, and abuse scenarios.
• Pay particular attention to adversarial threats involving fraud detection and bot mitigation, identifying weaknesses that could allow attackers to bypass or undermine platform protections.
• Collaborate with penetration testing and compliance specialists to scope assessments, validate fixes, retest findings, and translate technical discoveries into actionable engineering work.
• Lead technical investigations of application‑layer security incidents, coordinating containment, root‑cause analysis, remediation, and collaboration with cloud infrastructure teams when necessary.
• Define application security logging and alerting requirements and partner with engineering and cloud platform teams to implement effective detection capabilities.
• Support engineering teams through security consultations, office hours, secure coding guidance, and a Security Champions program that expands security expertise across the organization.
• Develop practical secure coding training based on real application code, vulnerabilities, and lessons learned from security incidents.
• Mentor engineers through code reviews and architecture feedback, helping improve security awareness and engineering quality without relying solely on mandates.
• Partner with application security leadership to shape technical priorities, communicate findings and risk assessments, and execute initiatives that advance the broader security roadmap.
• Provide technical evidence for security controls, contribute to vendor security assessments, and support enterprise customer due diligence, security questionnaires, architecture discussions, and penetration testing summaries.

Skills

Software engineering

Application security

Threat modeling

Code reviews

AI-assisted security

Tools

SAST

DAST

SCA

Secrets detection

Container scanning

IaC scanning

CI/CD integration

Job description

Jobgether is partnering to hire a Staff Application Security Engineer based in Italy. You will establish and scale a secure SDLC, integrate SAST/DAST/SCA into CI/CD, and lead threat modeling across APIs, SDKs, and cloud systems.

The role emphasizes hands‑on engineering and AI‑assisted security tooling to advance product security at scale. You will collaborate with engineering teams and security leadership, guiding secure coding practices and building reusable security patterns while managing