application security engineer in fintech

HireHi; Portugal; Híbrido; EUR 90 000 - 130 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Health and dental insurance

Equity

Paid time off

Resumo da oferta

HireHi is seeking a technically strong Senior Application Security practitioner to own and mature the Secure Design program. You will work with the Head of AppSec to drive shift-left initiatives, review design, and integrate security into CI/CD.

You will own API security, assist with offensive security, and build Python-based automation to scale AppSec capacity. You will collaborate with developers on SAST/SCA remediation, optimize scans, and help define AI-assisted security pipelines and

Qualificações

• Hands-on experience across secure design, threat modeling, API security, and offensive security.
• Penetration testing experience with real-world API exploitation patterns.
• Deep familiarity with OWASP Top 10 in practice.
• Experience assessing REST and GraphQL APIs.
• Proficiency in Python; able to build automation tools.
• Experience in shift-left programs (CI/CD, developer enablement, and design reviews).
• Understanding of web application and API security; read code across languages.
• Familiarity with cloud-native environments and attack surface management.
• Ability to influence across engineering and product at architecture level.
• Nice-to-have: OSCP, OSWE, GWEB, CISSP, CEH; exposure to AI-assisted security tooling.

Responsabilidades

• Build and mature the Secure Design and Threat Modeling program by defining methodology, review standards, and sign-off criteria across the organization
• Drive shift-left security initiatives by embedding security earlier in the development lifecycle through design reviews, developer enablement, and security gating in CI/CD
• Own API security as a discipline
• Support offensive security initiatives
• Build and maintain security automation in Python to scale AppSec capacity
• Work directly with developers on SAST and SCA remediation, scan optimization, and reducing friction in the security feedback loop
• Contribute to AI-assisted security pipelines and define escalation paths, SLAs, and accountability structures for vulnerability management

Conhecimentos

Secure design

Threat modeling

API security

Offensive security

Penetration testing

OWASP Top 10

REST/GraphQL

Python automation

CI/CD security

Ferramentas

Python Automation Tools

Descrição da oferta de emprego

Описание

We are looking for a technically strong Senior Application Security practitioner ready to take on real ownership. You will work directly with the Head of AppSec, contributing to the Secure Design practice and helping drive shift-left security across the organization.

Задачи

• Build and mature the Secure Design and Threat Modeling program by defining methodology, review standards, and sign-off criteria across the organization
• Drive shift-left security initiatives by embedding security earlier in the development lifecycle through design reviews, developer enablement, and security gating in CI/CD
• Own API security as a discipline
• Support offensive security initiatives
• Build and maintain security automation in Python to scale AppSec capacity
• Work directly with developers on SAST and SCA remediation, scan optimization, and reducing friction in the security feedback loop
• Contribute to AI-assisted security pipelines and define escalation paths, SLAs, and accountability structures for vulnerability management

Требования

• Hands-on experience across secure design, threat modeling, API security, and offensive security
• Penetration testing experience and a solid understanding of real-world attack and API exploitation patterns
• Deep familiarity with OWASP Top 10 in practice
• Experience assessing REST and GraphQL APIs
• Proficiency in Python and ability to build automation tools others can depend on
• Experience in shift-left programs, including security in CI/CD, developer enablement, and design review processes
• Understanding of web application and API security
• Ability to read code across languages and engage with engineering teams at technical depth
• Familiarity with cloud-native environments and attack surface management
• Ability to influence across engineering and product and operate at architecture level
• Будет плюсом: OSCP, OSWE, GWEB, CSSLP, CISSP, or CEH certifications, exposure to AI-assisted security tooling or LLM security, experience as a developer, fluency in Ruby, Python, and Scala

Условия

• Employees in this role work in the office four days and remotely one day (Friday)
• Competitive salary, annual performance bonus, and equity for full-time employees
• 100% Employer-paid health and dental insurance
• Generous paid time off (PTO)