Application Security Engineer In Fintech

Icapital; Viseu; Hybrid; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Equity

Paid time off

Job summary

Icapital is seeking a Senior Application Security practitioner to take ownership of the Secure Design program and drive shift-left security across the fintech focused organization. You will work closely with the Head of App Sec to mature threat modeling, API security, and automation initiatives.

You will build security tooling in Python, collaborate with developers on SAST/SCA remediation, and help establish escalation paths, SLAs, and vulnerability management processes in a fast-paced

Qualifications

• Hands-on security design, threat modeling and API security.
• Experience with REST/GraphQL API security assessments.
• Proficiency in Python for building automation tools.

Responsibilities

• Build and mature Secure Design and Threat Modeling program across the organization.
• Drive shift-left security by embedding security early in the Dev lifecycle via design reviews, enablement and CI/CD gating.
• Own API security as a discipline and lead remediation efforts.
• Support offensive security initiatives and security automation in Python.
• Collaborate with developers on SAST/SCA remediation and optimize security feedback loop.

Skills

Secure design

Threat modeling

API security

Offensive security

Python automation

CI/CD security

SAST remediation

SCA remediation

Threat detection

Job description

Описание We are looking for a technically strong Senior Application Security practitioner ready to take on real ownership. You will work directly with the Head of App Sec, contributing to the Secure Design practice and helping drive shift-left security across the organization.

Задачи Build and mature the Secure Design and Threat Modeling program by defining methodology, review standards, and sign-off criteria across the organization Drive shift-left security initiatives by embedding security earlier in the development lifecycle through design reviews, developer enablement, and security gating in CI/CD Own API security as a discipline Support offensive security initiatives Build and maintain security automation in Python to scale App Sec capacity Work directly with developers on SAST and SCA remediation, scan optimization, and reducing friction in the security feedback loop Contribute to AI-assisted security pipelines and define escalation paths, SLAs, and accountability structures for vulnerability management Требования Hands-on experience across secure design, threat modeling, API security, and offensive security Penetration testing experience and a solid understanding of real-world attack and API exploitation patterns Deep familiarity with OWASP Top 10 in practice Experience assessing REST and Graph QL APIs Proficiency in Python and ability to build automation tools others can depend on Experience in shift-left programs, including security in CI/CD, developer enablement, and design review processes Understanding of web application and API security Ability to read code across languages and engage with engineering teams at technical depth Familiarity with cloud-native environments and attack surface management Ability to influence across engineering and product and operate at architecture level Будет плюсом: OSCP, OSWE, GWEB, CSSLP, CISSP, or CEH certifications, exposure to AI-assisted security tooling or LLM security, experience as a developer, fluency in Ruby, Python, and Scala Условия Employees in this role work in the office four days and remotely one day (Friday) Competitive salary, annual performance bonus, and equity for full-time employees 100% Employer-paid health and dental insurance Generous paid time off (PTO)

Application Security Engineer In Fintech • Portalegre, Portuguese Republic, PT