AppSec Engineer: Build Secure Apps & Lead Threat Testing

Revolut; Portugal; On-site; EUR 65,000 - 100,000; Full time

Job summary

Revolut is seeking an Application Security Engineer in Portugal to design, test, and fortify our software. You will perform security assessments on mobile, web, and API stacks, participate in threat-led testing, and lead penetration testing across applications and infrastructure.

You’ll manage the bug bounty program, work closely with DevOps on cloud security, and guide secure architectural decisions. You’ll embed security in the SDLC, develop internal standards aligned with OWASP and NIST, and

Qualifications

• 3+ years in application security or related field.
• Knowledge of OWASP Top 10 and CWE.
• Experience in code reviews, design reviews, and threat modelling.
• CI/CD security integration and DevSecOps.
• Cloud security in GCP or AWS.
• Strong communication across teams.

Responsibilities

• Perform security assessments on product designs, mobile apps, web apps, and APIs.
• Lead Red Team exercises and threat-led testing to simulate attackers.
• Conduct penetration testing across apps, infra and APIs using manual and automated methods.
• Manage and evolve private bug bounty program, validate submissions and coordinate with researchers.
• Influence cloud security posture with DevOps to implement best practices in GCP/AWS.
• Collaborate with engineering to embed security into the SDLC and provide guidance on architecture and threat modelling.
• Develop and enforce internal AppSec standards aligned with OWASP, NIST, and industry benchmarks.
• Research emerging threats, tools, and technologies to stay ahead.
• Support security training and mentorship for junior team members.

Skills

Security testing

Threat modelling

Code reviews

CI/CD security

Cloud security

Burp Suite

MobSF

Frida

Auth & sessions

Communication

Team collaboration

Tools

Burp Suite

MobSF

Frida

Custom scripts

Job description

Revolut is seeking an Application Security Engineer in Portugal to design, test, and fortify our software. You will perform security assessments on mobile, web, and API stacks, participate in threat-led testing, and lead penetration testing across applications and infrastructure.

You’ll manage the bug bounty program, work closely with DevOps on cloud security, and guide secure architectural decisions. You’ll embed security in the SDLC, develop internal standards aligned with OWASP and NIST, and