Senior App Security Engineer — Lead Secure-by-Design, Hybrid

Capital; Warszawa; Hybrid; PLN 320,000 - 460,000; Part time

Benefits offered by this job

Hybrid work model

Medical insurance

Pension fund

Annual bonus

Generous annual leave

Workation policy

Volunteer leave

Job summary

Capital.com is seeking a Senior/Staff Application Security Engineer to raise the bar for security across the organization. You will lead architecture reviews, threat modelling, and develop scalable, self-serve security capabilities for multiple engineering teams.

You will mentor engineers, advance security testing, and drive secure design in cloud-native architectures, including AI-assisted tooling and robust SDLC integrations.

Qualifications

• 5+ years in application or product security and a track record of senior impact.
• Experience leading security architecture reviews and threat modelling across multiple teams/products.
• Ability to automate and scale security processes by building tooling and self-serve workflows.

Responsibilities

• Lead security architecture reviews and threat modelling for new/existing systems.
• Design, build, and automate scalable security processes across SDLC/CI/CD pipelines.
• Conduct security assessments of apps, APIs, and cloud infrastructure and manage vulnerability triage.
• Mentor engineers and deliver training to development and QA teams.
• Secure Kubernetes, AWS, and AI harnesses; drive secure design practices.

Skills

Security testing

Threat modelling

Automation

Python

JavaScript

AI tooling

CI/CD

Kubernetes security

AWS security

Tools

DefectDojo

SAST

DAST

SCA

IaC scanning

Job description

Capital.com is seeking a Senior/Staff Application Security Engineer to raise the bar for security across the organization. You will lead architecture reviews, threat modelling, and develop scalable, self-serve security capabilities for multiple engineering teams.

You will mentor engineers, advance security testing, and drive secure design in cloud-native architectures, including AI-assisted tooling and robust SDLC integrations.