Application Security Engineer

Belsoftsolutions; Portugal; Remote; EUR 50,000 - 75,000; Full time

Job summary

Belsoftsolutions is seeking a security-minded engineer to audit SaaS apps and Belsoftsolutions' own products, ensuring deployments are secure before release.

You will run hands-on audits of tools built with Lovable, Bolt, Cursor, v0, and Replit; test authentication, access controls, and API routes; review dependencies; and turn findings into automated checks in DeployReady. Strong JavaScript/TypeScript, Node.js, and OWASP Top 10 knowledge are essential.

Qualifications

• Solid understanding of the OWASP Top 10.
• Experience reviewing npm packages and dependency risk.
• Ability to explain vulnerabilities to non-security developers.
• Proven track record reporting security issues.

Responsibilities

• Perform hands-on security audits of SaaS products and apps.
• Test authentication, access control, including IDOR, and API routes.
• Review npm dependencies and supply-chain risk in Node.js projects.
• Assess AI features for prompt injection and data leakage.
• Review Belsoftsolutions' products before release.
• Write findings reports with fixes and retest.
• Turn recurring findings into automated checks in DeployReady.

Skills

JavaScript

TypeScript

Node.js

OWASP Top 10

Security testing

Communication

Tools

npm

lockfiles

Supabase

Firebase

Job description

AI coding tools let people ship in a weekend, along with exposed keys, open database rules, and API routes anyone can call. You'll audit those apps and established SaaS products, fix what you find alongside their builders, and make sure every product we build ourselves is secure before we sell it. What you learn feeds into our tooling, including DeployReady, our open-source scanner.

What you'll do

• Run hands-on security audits of SaaS products and apps built with Lovable, Bolt, Cursor, v0, and Replit
• Test auth, access control (including IDOR), Supabase/Firebase rules, and API routes
• Review npm dependencies and supply-chain risk in Node.js and JavaScript projects
• Assess AI features for prompt injection, data leakage, and over-permissioned tools
• Review Belsoft's own products and client platforms before release
• Write clear findings reports with exact fixes, then retest
• Turn recurring findings into automated checks in our tooling, including DeployReady

What you bring

• Strong JavaScript/TypeScript and Node.js
• Solid understanding of the OWASP Top 10 and web application security testing
• Experience reviewing npm packages, lockfiles, and dependency risk
• Ability to explain a vulnerability clearly to a non-security developer
• You've found and responsibly reported real security issues

Nice to have

• Experience with Supabase, Firebase, or other backend-as-a-service platforms
• Familiarity with Babel/AST tooling or static analysis
• LLM security experience, bug bounties, or security certifications