Senior App Security Engineer — Hybrid (Lisbon)

Shakers; Lisboa; Hybrid; EUR 60,000 - 90,000; Full time

Job summary

Shakers is seeking an Application Security Engineer in Lisbon, combining software development with security to bridge development, architecture, operations and corporate security.

You will champion secure development practices, run threat modelling, participate in architecture reviews and drive secure coding across CI/CD, leveraging OWASP Top 10, ASVS and cloud security tooling. Fluent English required; hybrid work with 2 days on site at Lagoas Park.

Qualifications

• Senior profile with hands-on development in Java and/or C#
• Cloud knowledge with real deployment experience (AWS/Azure)
• Linux and shell scripting experience
• Strong knowledge of OWASP Top 10, ASVS, threat modelling, OAuth2/OIDC/JWT, API security
• Experience with security tooling (SonarQube, Checkmarx, Fortify, Snyk, Burp Suite, Trivy, OWASP ZAP, Dependabot)
• Strong analytical skills and pragmatic risk mindset, excellent communication, ability to influence without authority
• Fluent English
• Frontend knowledge (Angular) is a plus; GCP transferable

Responsibilities

• Define and promote secure development practices
• Run threat modelling sessions
• Take part in architecture reviews
• Support authentication, authorisation and data protection mechanisms
• Analyse, classify and prioritise risks from pentests, SAST, DAST, dependency scanning and container scanning
• Support engineering teams through remediation within SLA
• Scope external pentests with vendors
• Validate findings
• Integrate automated security controls into CI/CD pipelines
• Define security metrics
• Deliver Secure Coding workshops on the OWASP Top 10
• Write technical guidelines
• Help run a Security Champions network

Skills

Java

C# .NET

Cloud (AWS/Azure)

Linux

Shell scripting

Threat modelling

OWASP Top 10

ASVS

OAuth2/JWT

API security

Cryptography

Secrets management

Communication skills

English fluency

Tools

SonarQube

Checkmarx

Fortify

Snyk

Burp Suite

Trivy

OWASP ZAP

Dependabot

Job description

Shakers is seeking an Application Security Engineer in Lisbon, combining software development with security to bridge development, architecture, operations and corporate security.

You will champion secure development practices, run threat modelling, participate in architecture reviews and drive secure coding across CI/CD, leveraging OWASP Top 10, ASVS and cloud security tooling. Fluent English required; hybrid work with 2 days on site at Lagoas Park.