Application security engineer

Shakers; Lisboa; Hybrid; EUR 60,000 - 90,000; Full time

Job summary

Shakers is seeking an Application Security Engineer in Lisbon, combining software development with security to bridge development, architecture, operations and corporate security.

You will champion secure development practices, run threat modelling, participate in architecture reviews and drive secure coding across CI/CD, leveraging OWASP Top 10, ASVS and cloud security tooling. Fluent English required; hybrid work with 2 days on site at Lagoas Park.

Qualifications

• Senior profile with hands-on development in Java and/or C#
• Cloud knowledge with real deployment experience (AWS/Azure)
• Linux and shell scripting experience
• Strong knowledge of OWASP Top 10, ASVS, threat modelling, OAuth2/OIDC/JWT, API security
• Experience with security tooling (SonarQube, Checkmarx, Fortify, Snyk, Burp Suite, Trivy, OWASP ZAP, Dependabot)
• Strong analytical skills and pragmatic risk mindset, excellent communication, ability to influence without authority
• Fluent English
• Frontend knowledge (Angular) is a plus; GCP transferable

Responsibilities

• Define and promote secure development practices
• Run threat modelling sessions
• Take part in architecture reviews
• Support authentication, authorisation and data protection mechanisms
• Analyse, classify and prioritise risks from pentests, SAST, DAST, dependency scanning and container scanning
• Support engineering teams through remediation within SLA
• Scope external pentests with vendors
• Validate findings
• Integrate automated security controls into CI/CD pipelines
• Define security metrics
• Deliver Secure Coding workshops on the OWASP Top 10
• Write technical guidelines
• Help run a Security Champions network

Skills

Java

C# .NET

Cloud (AWS/Azure)

Linux

Shell scripting

Threat modelling

OWASP Top 10

ASVS

OAuth2/JWT

API security

Cryptography

Secrets management

Communication skills

English fluency

Tools

SonarQube

Checkmarx

Fortify

Snyk

Burp Suite

Trivy

OWASP ZAP

Dependabot

Job description

Описание:

We are hiring an Application Security Engineer for a leading European technology group, through Shakers. The role suits someone with a software development background who moved into application security, acting as a bridge between development, architecture, operations and corporate security.

Задачи:

• Define and promote secure development practices
• run threat modelling sessions
• take part in architecture reviews
• Support the implementation of authentication, authorisation and data protection mechanisms
• Analyse, classify and prioritise risks coming from pentests, vulnerability assessments, SAST, DAST, dependency scanning and container scanning
• support engineering teams through remediation within SLA
• Scope external pentests with vendors
• validate findings
• integrate automated security controls into CI/CD pipelines
• define security metrics
• Deliver Secure Coding workshops on the OWASP Top 10
• write technical guidelines
• help run a Security Champions network

Требования:

• Senior profile
• Solid hands-on development experience in Java (Spring Boot, REST APIs, Maven) and/or C# .NET (.NET Core, ASP.NET)
• Mandatory cloud knowledge with real deployment experience, preferably AWS and/or Azure
• Plus Linux and shell scripting
• Practical command of OWASP Top 10 and ASVS, threat modelling, OAuth2/OIDC/JWT, API security, applied cryptography and secrets management
• Experience with tooling such as SonarQube, Checkmarx, Fortify, Snyk, Burp Suite, Trivy, OWASP ZAP and Dependabot
• Strong analytical skills a pragmatic approach to risk excellent communication the ability to influence without hierarchical authority Fluent English
• Будет плюсом: Frontend knowledge in Angular is valued; GCP is considered transferable

Условия:

Full time, long term Hybrid, 2 days per week on site at Lagoas Park, Lisbon