Application Security Engineer: Threat Modeling & Testing

n11; Sarıyer; On-site; TRY 350,000 - 520,000; Full time

Job summary

n11 is seeking an Application Security Engineer to join our Technology/Infrastructure Department. You will perform penetration testing, vulnerability assessments, and threat modeling across web apps, infrastructure, and cloud environments.

You will lead remediation efforts, collaborate with DevOps and product teams, and advance security in CI/CD pipelines. A strong bug bounty background and experience with OWASP standards are highly valued.

Qualifications

• Bachelor's degree or equivalent practical experience.
• 4+ years in computer tech field (IT, support, or engineering).
• Proficient in at least one programming language (e.g., Java, Golang) and scripting (Bash/Python).
• Hands-on experience with application security practices (SAST/DAST/SSA, threat modeling).
• Experience in application penetration testing, vulnerability research, or bug bounty hunting.
• Strong understanding of SSDLC and OWASP Top 10 vulnerabilities.

Responsibilities

• Penetration testing of web apps, infrastructure, and cloud environments.
• Vulnerability management and remediation in development and production.
• Communicate findings and remediation steps to stakeholders.
• Develop automation scripts to support security testing in CI/CD pipelines.
• Oversee attack surface management and proactive security measures.
• Collaborate with DevOps, QA, and product teams to embed security.

Skills

Java

Golang

Python

Bash

Education

Bachelor's degree in Computer Science or related field

Tools

OWASP

SAST

DAST

SCA

WAF

Job description

n11 is seeking an Application Security Engineer to join our Technology/Infrastructure Department. You will perform penetration testing, vulnerability assessments, and threat modeling across web apps, infrastructure, and cloud environments.

You will lead remediation efforts, collaborate with DevOps and product teams, and advance security in CI/CD pipelines. A strong bug bounty background and experience with OWASP standards are highly valued.