Senior AppSec Engineer - DevSecOps & Secure SDLC Lead

Duco; Wrocław; Ibrido; PLN 260.000 - 380.000; Tempo pieno

Vantaggi offerti da questo lavoro

Hybrid working policy – 2 days in the

Private Medical Insurance

Life Insurance

Unlimited annual holiday

Descrizione del lavoro

Duco is seeking a Senior Application Security Engineer to own security across the SDLC, focusing on ASPM (Ox Security) and integrating security guardrails into CI/CD pipelines. You will prioritize exploitable vulnerabilities and collaborate with engineering to remediate, while leading threat modelling and secure design reviews.

You will also help drive client assurance discussions, maintain security metrics, and monitor evolving threats in the data automation platform used by top financial

Competenze

• Proven experience in application security/SaaS DevSecOps
• Hands-on with CI/CD security tooling
• Ability to translate findings into remediation actions
• Reading code in Java, Ruby or Python
• Experience with AWS and IaC
• Proven threat modelling experience
• Familiarity with LLM/AI security a plus

Mansioni

• Own secure SDLC and pipeline security across CI/CD
• Maintain ASPM platform and reduce noise in findings
• Define threat modelling approach for features and architecture
• Promote secure coding practices and run security training
• Support client assurance activities with evidence of secure practices
• Monitor emerging application and supply chain threats

Conoscenze

SAST integration

SCA

OWASP Top 10

Threat modelling

Python

AWS

CI/CD tooling

Security tooling

Strumenti

Ox Security

Descrizione del lavoro

Duco is seeking a Senior Application Security Engineer to own security across the SDLC, focusing on ASPM (Ox Security) and integrating security guardrails into CI/CD pipelines. You will prioritize exploitable vulnerabilities and collaborate with engineering to remediate, while leading threat modelling and secure design reviews.

You will also help drive client assurance discussions, maintain security metrics, and monitor evolving threats in the data automation platform used by top financial