Senior AppSec Engineer - DevSecOps & Secure SDLC Lead

Duco; Wrocław; Hybrid; PLN 260,000 - 380,000; Full time

Benefits offered by this job

Hybrid working policy – 2 days in the

Private Medical Insurance

Life Insurance

Unlimited annual holiday

Job summary

Duco is seeking a Senior Application Security Engineer to own security across the SDLC, focusing on ASPM (Ox Security) and integrating security guardrails into CI/CD pipelines. You will prioritize exploitable vulnerabilities and collaborate with engineering to remediate, while leading threat modelling and secure design reviews.

You will also help drive client assurance discussions, maintain security metrics, and monitor evolving threats in the data automation platform used by top financial

Qualifications

• Proven experience in application security/SaaS DevSecOps
• Hands-on with CI/CD security tooling
• Ability to translate findings into remediation actions
• Reading code in Java, Ruby or Python
• Experience with AWS and IaC
• Proven threat modelling experience
• Familiarity with LLM/AI security a plus

Responsibilities

• Own secure SDLC and pipeline security across CI/CD
• Maintain ASPM platform and reduce noise in findings
• Define threat modelling approach for features and architecture
• Promote secure coding practices and run security training
• Support client assurance activities with evidence of secure practices
• Monitor emerging application and supply chain threats

Skills

SAST integration

SCA

OWASP Top 10

Threat modelling

Python

AWS

CI/CD tooling

Security tooling

Tools

Ox Security

Job description

Duco is seeking a Senior Application Security Engineer to own security across the SDLC, focusing on ASPM (Ox Security) and integrating security guardrails into CI/CD pipelines. You will prioritize exploitable vulnerabilities and collaborate with engineering to remediate, while leading threat modelling and secure design reviews.

You will also help drive client assurance discussions, maintain security metrics, and monitor evolving threats in the data automation platform used by top financial