Application Security Engineer: SDLC & Threat Modeling

Jobtailor; Lisboa; Presencial; EUR 60 000 - 80 000; Tempo integral

Resumo da oferta

Jobtailor in Portugal is seeking an experienced security-focused engineer to define and promote Secure SDLC practices, integrating security into architecture and development. You will lead threat modeling, review security findings, and coordinate testing activities across teams.

You will guide remediation efforts, implement secure coding standards, and embed security into CI/CD pipelines. The role emphasizes collaboration with development teams and security advocacy across projects.

Qualificações

• 5+ years of professional experience in software development or application security.
• Strong knowledge of OWASP Top 10, OWASP ASVS, Secure Coding and Threat Modeling.
• Experience with OAuth2, OpenID Connect, JWT, API Security and TLS.
• Proficient in Java/Spring Boot or C#/ .NET with REST APIs.
• Cloud deployment experience, preferably AWS or Azure.
• Linux and shell scripting knowledge.
• Experience with security tools such as SonarQube, Checkmarx, Fortify, Veracode, Snyk, Dependabot, OWASP ZAP, Burp Suite or Trivy.
• Able to translate security findings into remediation.
• Strong communication and collaboration as security advisor.

Responsabilidades

• Define and promote Secure SDLC and Security-by-Design practices.
• Integrate security requirements into application architecture, design and development.
• Lead or facilitate Threat Modeling and application security reviews.
• Analyze and prioritize vulnerabilities identified through SAST, DAST, SCA, container scanning, vulnerability assessments and penetration tests.
• Coordinate penetration testing activities, including scope definition, external providers, findings validation and remediation follow-up.
• Provide hands-on support to development teams in vulnerability remediation and secure coding.
• Promote best practices around authentication, authorization, API security, data protection, cryptography and secrets management.
• Integrate security controls and automated security testing into CI/CD pipelines, supporting DevSecOps adoption.
• Develop security guidelines, standards and metrics.
• Promote security awareness through Secure Coding workshops and Security Champions.

Conhecimentos

Application Security

Threat Modeling

Secure Coding

Java/Spring Boot

C#/ .NET

Cloud Environments

Linux

Shell Scripting

Communication

Security Advocacy

DevSecOps

Ferramentas

SonarQube

Checkmarx

Fortify

Veracode

Snyk

Dependabot

OWASP ZAP

Burp Suite

Trivy

Descrição da oferta de emprego

Jobtailor in Portugal is seeking an experienced security-focused engineer to define and promote Secure SDLC practices, integrating security into architecture and development. You will lead threat modeling, review security findings, and coordinate testing activities across teams.

You will guide remediation efforts, implement secure coding standards, and embed security into CI/CD pipelines. The role emphasizes collaboration with development teams and security advocacy across projects.