Lead Application Security Engineer, SDLC & CI/CD

Duco; Polska; Ibrido; PLN 180.000 - 240.000; Tempo pieno

Vantaggi offerti da questo lavoro

Private Medical Insurance

Life Insurance

Multisport Program

Unlimited annual holidays

Enhanced family leave

Employee Assistance Programme

Volunteer days off

Referral bonus

Descrizione del lavoro

Duco is seeking an experienced Senior Application Security Engineer to own security across the SDLC and CI/CD pipelines. You will manage the ASPM platform, Ox Security, and translate findings into effective remediation with engineering teams.

You will lead threat modelling, secure design reviews, and promote secure coding practices across Engineering, while collaborating with the GRC and SI teams. This role is based in a distributed team across London and Wrocław.

Competenze

• 7+ years in an application security, product security or DevSecOps role, ideally in SaaS.
• Hands-on experience integrating security tooling into CI/CD pipelines.
• Ability to translate findings into prioritized remediation actions.
• Strong understanding of vulnerability classes and OWASP Top 10 with practical remediations.
• Ability to read and review code in Java, Ruby or Python.
• Experience with threat modelling alongside engineering teams.
• Working knowledge of AWS and IaC.
• Proficiency in Python or similar scripting for automation.
• Credibility with developers and ability to influence risk discussions.
• Hands-on experience with ASPM/ Ox Security or similar.
• Background in software engineering prior to security.
• Experience with software supply chain security (SLSA, SBOMs, artefact signing).
• Container and Kubernetes security experience including image scanning and admission controls.
• Experience with policy-as-code tooling.
• Experience establishing security champions programme.
• Experience securing LLM/agentic AI capabilities with OWASP Top 10 for AI apps.
• Familiarity with financial regs such as DORA, ISO27001, SOC 2.
• Certifications such as OSWE, GWAPT, CSSLP or AWS Certified Security – Specialty.

Mansioni

• Secure SDLC and pipeline security across CI/CD, embedding secure delivery as default.
• Build and maintain pipeline security guardrails (SAST, SCA, secrets scanning, IaC and container scanning).
• Strengthen software supply chain security (SBOMs, build provenance).
• Define pre-deployment cloud guardrails with policy-as-code.
• Own Ox Security ASPM platform: tune policies, reduce noise and prioritize findings.
• Drive remediation with engineering leads and SLAs, report progress.
• Coordinate application penetration testing and remediation tracking.
• Lead threat modelling for new features and major architectural changes.
• Conduct secure design reviews and promote secure coding practices via guidance and security champions.
• Represent platform security in client reviews and audits; report security metrics.
• Monitor emerging threats including AI/agentic capabilities.

Conoscenze

CI/CD security tooling

Application security

Threat modelling

OWASP Top 10

Code review (Java, Ruby, Python)

AWS & IaC

Python scripting

Security champions network

LLM security

SLSA / SBOM

Container & Kubernetes security

Policy-as-code

Strumenti

SAST

SCA

Secrets scanning

IaC scanning

Container image scanning

Policy-as-code tooling

Ox Security platform

Descrizione del lavoro

Duco is seeking an experienced Senior Application Security Engineer to own security across the SDLC and CI/CD pipelines. You will manage the ASPM platform, Ox Security, and translate findings into effective remediation with engineering teams.

You will lead threat modelling, secure design reviews, and promote secure coding practices across Engineering, while collaborating with the GRC and SI teams. This role is based in a distributed team across London and Wrocław.