Hybrid AppSec Architect: Secure-by-Design at Scale

Lever, Inc.; Warszawa; Hybrid; PLN 260,000 - 380,000; Full time

Benefits offered by this job

Annual bonus

Generous annual leave

Medical insurance

Pension fund

Hybrid work model

Remote work days

Workation policy

Volunteer leave

Job summary

Capital.com builds and operates web and mobile trading platforms, public and partner APIs, and backend services in a regulated environment. As Application Security Architect, you will be the senior design authority for the security of these products, owning secure-by-design patterns and standards, lead threat modelling and architecture reviews.

You will guide AppSec processes, balance protection with developer experience, and earn adoption through enablement rather than mandates.

Qualifications

• 8+ years in technology with 5+ years in application/security design ownership.
• Proven track record creating and rolling out security standards across a complex org.
• Deep threat-modelling experience across product portfolios.

Responsibilities

• Define and maintain secure-by-default reference architectures for web apps, mobile backends, and APIs.
• Own core application security architecture decisions: auth, API security, secrets, multi-tenant isolation, logging.
• Lead redesign of user authentication and security feature delivery.
• Develop and roll out security standards, secure-coding guidelines, and ADRs.
• Define security requirements for acquired tech and its integration.

Skills

Threat modelling

Security architecture

Cloud security

Influence without authority

Mentoring

Tools

SAST

DAST

IAST

SCA

Secrets scanning

Job description

Capital.com builds and operates web and mobile trading platforms, public and partner APIs, and backend services in a regulated environment. As Application Security Architect, you will be the senior design authority for the security of these products, owning secure-by-design patterns and standards, lead threat modelling and architecture reviews.

You will guide AppSec processes, balance protection with developer experience, and earn adoption through enablement rather than mandates.