Application Security Engineer

Yora; Göteborgs kommun; On-site; SEK 600,000 - 900,000; Full time

Job summary

Yora is seeking a skilled Application Security Engineer in Göteborg, Sweden. In this role, you will work closely with developers and architects to enhance secure development practices. Responsibilities include improving CI/CD security, performing threat modeling, and supporting teams in mitigating security risks. The ideal candidate has hands-on experience in Application Security, a strong understanding of modern software development, and is fluent in both Swedish and English.

Qualifications

• Hands-on experience within Application Security or Product Security.
• Strong understanding of modern software development and CI/CD pipelines.
• Experience with secure-by-design methodologies.

Responsibilities

• Support and improve Secure Software Development Lifecycle (SSDLC) practices.
• Perform threat modeling and security risk assessments.
• Work hands-on with SAST, DAST, and SCA tooling.
• Improve security in CI/CD pipelines and developer workflows.
• Support development teams with secure coding and security best practices.

Skills

Application Security

CI/CD pipelines

SAST

DAST

API Security

Threat modeling

Cloud platforms (AWS, Azure, GCP)

Kubernetes security

DevSecOps

Fluent in Swedish and English

Tools

SAST tools

DAST tools

SCA tools

Job description

We’re looking for a skilled Application Security Engineer to join a team working with modern software platforms, secure development practices, and product security in complex enterprise environments. If you enjoy working close to developers, automation, and secure software delivery, this role offers the opportunity to make a real impact.

About the Role

As an Application Security Engineer, you will work closely with development teams, architects, and platform engineers to improve how security is integrated into the software development lifecycle.

You’ll contribute to building secure development practices, improving CI/CD security, and supporting teams in identifying and mitigating security risks early in the development process.

This is not just a governance role. You’ll be involved in hands‑on security engineering, automation, technical advisory, and continuous improvement across modern application environments.

What You’ll Do

• Support and improve Secure Software Development Lifecycle (SSDLC) practices
• Perform threat modeling and security risk assessments
• Work hands‑on with SAST, DAST, and SCA tooling
• Improve security in CI/CD pipelines and developer workflows
• Support development teams with secure coding and security best practices
• Contribute to API and web application security initiatives
• Collaborate with engineering teams to integrate security into modern platforms and cloud environments
• Drive security improvements from idea to implementation
• Contribute to security architecture and technical decision‑making
• Support and mentor teams in application security practices

What We’re Looking For

• Hands‑on experience within Application Security or Product Security
• Experience working closely with software development teams
• Strong understanding of modern software development and CI/CD pipelines
• Experience with SAST, DAST, SCA, and application security tooling
• Good understanding of OWASP Top 10, API Security, and threat modeling
• Experience with cloud platforms such as AWS, Azure, or GCP
• Familiarity with container and Kubernetes security
• Experience with DevSecOps and security automation
• Ability to work independently and take ownership of tasks and solutions
• Strong communication skills and ability to collaborate across teams
• Fluent in Swedish and English, both written and spoken

Must Have

• Fluent Swedish and English, both written and spoken
• Experience with secure‑by‑design methodologies
• Experience with container security and Kubernetes environments
• Familiarity with GitOps and modern deployment practices
• Experience with identity and access management
• Knowledge of offensive security or penetration testing
• Experience working in larger enterprise or security‑critical environments