Senior Security Engineer 'Application Security'

Yapı Kredi Teknoloji; İzmit; Hybrid; TRY 350,000 - 550,000; Full time

Benefits offered by this job

Hybrid model

Koç Group offices

Tech career path

BizClub privileges

Retirement insurance

Birthday off

Job summary

Yapı Kredi Technology in Turkey is seeking a security-focused engineer to perform application security assessments across web, mobile, and API layers within a modern DevSecOps environment.

You will lead threat modeling, design reviews, and vulnerability analysis, and help tune SAST/DAST/IAST/SCA tooling integrated with CI/CD pipelines, while staying current with cyber security threats and industry best practices.

Qualifications

• Perform application security assessments such as web, mobile, and API penetration tests.
• Perform threat modeling and design reviews as part of the Secure software development lifecycle and provide feedback to development teams on Cyber Security matters.
• Performing comprehensive and technical analysis of detected vulnerabilities
• Performing analysis, reviewing findings, tuning, and setting policies within application security (SAST, DAST, IAST, SCA) solutions
• Take part in network penetration tests and Red Team/Purple Team activities as needed
• Automate security testing at scale (DevSecOps)
• Participate in setting up, configuring and maintaining security tools on CI/CD infrastructure (DevSecOps)
• Taking active role in internal process, procedure and standard development studies.

Responsibilities

• Perform application security assessments such as web, mobile, and API penetration tests.
• Perform threat modeling and design reviews as part of the Secure software development lifecycle and provide feedback to development teams on matters of Cyber Security.
• Perform comprehensive and technical analysis of detected vulnerabilities.
• Perform analysis, reviewing findings, tuning, and setting policies within application security solutions (SAST/DAST/IAST/SCA).
• Conduct network penetration tests and Red/Purple Team activities as needed.
• Automate security testing at scale (DevSecOps) and maintain security tooling in CI/CD pipelines.
• Support internal process and standard development related to security.

Skills

Security engineering

Penetration testing

Threat modeling

Vulnerability analysis

DevSecOps

CI/CD security tooling

Education

Bachelor's degree in CS/EE/CE/Math

Tools

SAST tools

DAST tools

IAST tools

SCA tools

CI/CD security tooling

Job description

Yapı Kredi Technology is a technology company that produces innovative, high quality, and high value-added products and solutions in the finance sector. With more than 2,000 employees, it aims to create products that will shape the sector for Yapı Kredi Bank and to be the undisputed leader in the field of technology by using modern architectural systems and cloud technologies. It also contributes to the development of new and exemplary products for the sector by using natural language processing, machine learning, artificial intelligence, and data mining technologies with its R&D team.

Who We Are:

At Yapı Kredi Technology, we research with passion, wonder as we learn, and implement innovations that shape the future together. We take responsibility from the first day with our expert colleagues and work with all our strength for pioneering applications. We make quick decisions and take action. We quickly adapt to innovations and changes.

What Do We Offer:

• Opportunity to work in hybrid model
• Opportunity to work in Koç Group Community Companies' offices
• Career development opportunities in a structured technology career path
• Opportunity to benefit from BizClub and KoçAilem privileges exclusive to Yapı Kredi Technology employees
• Company-contributed individual retirement insurance
• Birthday off day.

Qualifications:

• Minimum 4 years between 10 years experienced in Security & Software Engineering related positions
• Bachelor's degree in Computer, Electronics, Communication Engineering, Mathematics or relevant fields
• Experience in Application Penetration testing (web, mobile, API, thick client etc.) and source code security analysis
• Openness to the continuous acquisition of new skills and competencies
• Stays current with latest cyber security threats and vulnerabilities

Pluses:

• Master's degree in Cyber Security of relevant field is a plus
• Holding an Offensive Security or Application Security related Certificate preferred
• Familiarity with web application frameworks, API technologies, and micro services preferred
• Experience with programming languages such as C, C#, Java, and Python preferred

Job Description:

• Perform application security assessments such as web application, mobile application and API penetration tests.
• Perform threat modeling and design reviews as part of the Secure software development lifecycle and provide feedback to development teams on matters of Cyber Security
• Performing comprehensive and technical analysis of detected vulnerabilities
• Performing analysis, reviewing findings, tune, and set policies within application security (SAST, DAST, IAST, SCA etc.) solutions
• Perform network penetration tests and execute Red Team/Purple Team activities as needed
• Automate security testing at scale (DevSecOps)
• Participate in setting up, configuring and maintaining security tools on CI/CD infrastructure (DevSecOps)
• Taking active role in internal process, procedure and standard development studies.

Our recruitment process for all positions typically encompasses technical interviews, director assessments, competency evaluations, and personality tests. We will extend our offer to candidates who have successfully completed a positive evaluation process.

If you would like to get to know more about Yapı Kredi Technology, you can follow us!