Staff AppSec Engineer — DevSecOps & Threat Modeling

Solaris; Sweden; On-site; SEK 1,324,210 - 1,986,316; Full time

Benefits offered by this job

Home office budget

Learning & development budget €1000/yr

Competitive salary & variable remunera

Monthly meal allowance

Deutschland ticket subsidy

28 vacation days + 2/3 day increases

Job summary

Solaris is Europe’s leading embedded finance platform and is seeking an experienced Application Security professional to integrate security into the SDLC and DevSecOps pipelines. You will automate security gates, perform threat modeling, and conduct deep-dive secure code reviews across multi‑tier cloud apps.

You will design secure-by-default libraries, own the vulnerability lifecycle, and partner with product and engineering to balance speed with security.

Qualifications

• 6+ years in Application Security, DevSecOps, or secure software engineering.
• Experience securing code in cloud-native environments (Fintech or regulated contexts a plus).
• Strong knowledge of OWASP Top 10, CWE, API security, and threat modeling.

Responsibilities

• Integrate security into the Software Development Lifecycle and DevSecOps pipelines via automated gates (SAST, DAST, SCA, container scanning).
• Conduct threat modeling and architectural security reviews for complex apps, APIs, and microservices.
• Perform deep-dive secure code reviews across codebases to identify vulnerabilities.
• Develop secure-by-default internal libraries and tools to reduce vulnerabilities.
• Own vulnerability lifecycle from triage to prioritization from internal tests and bug bounty programs.
• Provide mitigation guidance to product and engineering teams balancing velocity and security.

Skills

Java

Go

Python

TypeScript

Rust

Education

Bachelor's in CS / equivalent

Tools

GitHub Actions

GitLab CI

Jenkins

Snyk

Semgrep

Job description

Solaris is Europe’s leading embedded finance platform and is seeking an experienced Application Security professional to integrate security into the SDLC and DevSecOps pipelines. You will automate security gates, perform threat modeling, and conduct deep-dive secure code reviews across multi‑tier cloud apps.

You will design secure-by-default libraries, own the vulnerability lifecycle, and partner with product and engineering to balance speed with security.