Senior Application Security Engineer

inriver; Philippines; On-site; PHP 900,000 - 1,800,000; Full time

Job summary

inriver is seeking a Senior Application Security Engineer to own security across the SDLC end-to-end. You will work hands-on with engineering teams to find, fix, and prevent vulnerabilities in a .NET/Azure platform and help secure AI-powered features.

You will lead threat modeling, code reviews, and secure coding practices, while coordinating security tests and incident response with our 24/7 partner teams.

Qualifications

• 8+ years of experience in application security or security-focused software engineering.
• Experience integrating and operating security tooling within CI/CD pipelines.
• Strong .NET (C#) working knowledge; Python reading is a plus.
• Fluency in OWASP Top 10 and API security risks.
• Hands-on Azure experience: resources, networking, secrets management.
• Experience with Auth0 in production environments.

Responsibilities

• Own security in the SDLC end-to-end, hands-on, and independently.
• Build, integrate, and operate SAST, SCA, and DAST in Azure DevOps pipelines with gate checks.
• Secure cloud estate including identity, access management, and secrets management.
• Conduct threat modeling, design reviews, and code reviews before production.
• Evaluate AI feature security, including prompt injection and data leakage risks.
• Define and uphold secure coding standards and enable engineers to perform risk assessments.
• Coordinate penetration tests and vulnerability scans and act on findings.
• Support security incident investigation and response with the incident team.

Skills

Security mindset

CI/CD security

.NET (C#)

Python reading

Azure security

Auth0

Security communication

Threat modeling

Tools

SAST

SCA

DAST

Azure DevOps

Entra ID

Defender for Cloud

Job description

About The Role

We're looking for a Senior Application Security Engineer. You own security in the software development lifecycle (SDLC) - end to end, hands-on, and independently. You report to the CISO. The CISO sets direction, risk appetite, and handles executive escalation; you run application security day to day without needing constant support. You'll partner with engineering teams to find, fix, and prevent vulnerabilities in a platform built primarily on .NET and hosted in Azure, while helping us secure the next generation of AI-powered features. This is a hands-on role for someone who wants to make secure development the path of least resistance for our engineers.

What You'll Do

• Vulnerability management, end to end. Identify, triage, and drive security findings to closure through the product teams Azure DevOps backlogs with severity-based SLAs. Vulnerability management, end to end. Identify, triage, and drive security findings to closure through the product teams Azure DevOps backlogs with severity-based SLAs.
• Security tooling in CI/CD. Build, integrate, and operate SAST, SCA, and DAST in Azure DevOps pipelines, including PR gating on new critical and high findings, secret scanning, and automated routing of findings to tickets.
• Azure security. Secure our cloud estate across identity and access management (Entra ID, Auth0), network configuration, secrets management, and workload protection, working with Defender for Cloud policy and posture.
• Threat modeling and reviews. Conduct threat models, design reviews, and code reviews for new and existing services -- with a threat model in place before any new service reaches production.
• AI feature security. Evaluate security and privacy implications of our AI functionality, including LLM-specific risks such as prompt injection, data leakage, and model misuse, and define controls for them.
• Standards and enablement. Define and uphold secure coding standards, train engineers, and build a security champion in each product team so risk assessment becomes self-service rather than a security-team bottleneck.
• Pen tests and scans. Coordinate penetration tests and application vulnerability scanning, review the findings, identify fixes, and implement them hands-on when needed.
• Incident response. Support security incident investigation and response as the application subject-matter expert, working with our 24/7 managed detection and response partner.

What You'll Bring

• 8+ years of experience in application security, or in software engineering with a strong security focus.
• Experience integrating and operating security tooling within CI/CD pipelines.
• Strong .NET (C#) working knowledge; ability to read and reason about Python is a plus.
• Fluency in common vulnerability classes (OWASP Top 10, API security risks) and how they manifest in real code -- not just in scanner output.
• Hands-on Azure experience: creating resources, securing applications, Azure networking, and secrets management.
• Hands-on experience with Auth0 in production environments.
• Strong communication skills and the ability to influence engineers without owning their backlog.
• A pragmatic, risk-based mindset that balances security with delivery -- you know which findings matter and which are noise.

Inriver is a global leader in Product Information Management (PIM), helping more than 1,600 brands create outstanding product experiences. Behind our success is a team of talented, collaborative, and passionate people who enjoy solving complex challenges and making an impact for customers around the world.

Headquartered in Malmö, Sweden, we have colleagues across multiple locations globally, bringing together diverse perspectives, expertise, and experiences. For more information, visit www.inriver.com or follow us on LinkedIn.