Application security engineer

Zoolatech; United States; Remote; USD 124,000 - 207,000; Part time

Job summary

Zoolatech is seeking an experienced Application Security Engineer to join a collaboration with a leading European fashion and beauty retailer. You will focus on threat modeling, security architecture, and design reviews to help engineers build secure, cloud-native applications.

You will validate AI-assisted threat modeling results, advise on secure patterns, review authentication and API security, and promote OWASP practices across teams.

Qualifications

• 5–10 years of professional experience in Application Security.
• Hands-on threat modeling experience using STRIDE.
• Experience reviewing AI-assisted threat modeling outputs.
• App security architecture and technical design review experience.
• Strong knowledge of OWASP Top 10 for Web Applications and REST API security.
• Experience with OAuth2.0/2.1, OpenID Connect, JWT/JWS/JWE, mTLS, and SAML.
• Understanding RBAC/ABAC and policy-as-code approaches (OPA, Rego, Cedar).
• Familiarity with cloud-native architectures and backend technologies.
• Ability to communicate security risks clearly to engineers and architects.

Responsibilities

• Conduct structured threat modeling for web applications using STRIDE.
• Review and validate AI-assisted threat modeling outputs, identifying gaps.
• Perform application security architecture and technical design reviews early in SDLC.
• Recommend secure design patterns and practical mitigations for security risks.
• Review authentication/authorization, API security, tokens, and secrets handling.
• Collaborate with engineers and architects to embed security best practices.
• Provide clear, developer-friendly guidance on implementing controls and remediations.
• Assess security risks in AI/LLM-based apps and architectures with practical recommendations.
• Apply OWASP Top 10 standards for Web Apps and REST APIs.

Job description

Описание

Are you passionate about application security and helping engineering teams build secure, resilient applications? We are collaborating with a leading European Online Fashion & Beauty Retailer to find a highly capable and self-driven Application Security Engineer to support its growing security needs. This role is centered around threat modeling, application security architecture, and technical design reviews. You’ll work closely with software engineers and architects to identify potential security risks, validate AI-assisted threat modeling results, and provide practical, actionable recommendations to strengthen application security across the organization. You’ll also have the opportunity to contribute to securing AI-powered solutions and modern cloud-native applications.

Задачи

Conduct structured threat modeling for web applications and other application types, using established methodologies such as STRIDE. Review and validate threat modeling outputs generated by AI-assisted tools, identifying potential gaps and providing actionable security recommendations. Perform application security architecture and technical design reviews to identify security risks early in the development lifecycle. Recommend secure design patterns and practical mitigation strategies for application security risks. Review and advise on authentication and authorization mechanisms, API security, token management, and secrets handling. Collaborate closely with software engineers and architects to integrate security best practices into application design and development. Provide clear, developer-friendly guidance on implementing security controls and remediating identified risks. Assess security risks in AI/LLM-based applications and architectures, providing recommendations to help teams develop secure AI-powered solutions. Apply relevant security standards and best practices, including OWASP Top 10 for Web Applications and OWASP Top 10 for LLM Applications.

Требования

5–10 years of professional experience in Application Security. Strong hands‑on experience with manual threat modeling and threat modeling methodologies such as STRIDE. Experience reviewing and validating AI‑assisted or automated threat modeling outputs. Proven experience in application security architecture and technical design reviews. Strong understanding of secure software design principles, security controls, and risk mitigation strategies. Good knowledge of OWASP Top 10 for Web Applications and REST API security best practices. Experience with modern authentication and authorization protocols, including OAuth2.0/2.1, OpenID Connect (OIDC), JWT/JWS/JWE, mTLS, and SAML. Understanding of authorization models such as RBAC and ABAC, as well as policy‑as‑code approaches and tools like Open Policy Agent (OPA), Rego, or Cedar. Familiarity with modern cloud‑native application architectures and common backend technologies. Ability to communicate security risks clearly and provide practical, actionable recommendations to software engineers and architects. Strong analytical and problem‑solving skills, with the ability to work independently and collaborate effectively with cross‑functional teams.

Будет плюсом

Experience with AI/LLM application security and knowledge of the OWASP Top10 for LLM Applications; Familiarity with IDE or CI/CD integrations and automated or LLM‑assisted threat modeling tools; Experience assessing the security of AI‑powered solutions and reviewing AI system architectures.

Условия

This is an independent contractor opportunity based on a direct contractual relationship between Zoolatech and the individual service provider. To facilitate this direct partnership, we engage with professionals who are registered and operate as a sole proprietorship, private entrepreneur, or an equivalent self‑employment status in your country. Please note, our model does not accommodate contracts through third‑party intermediaries such as agencies, incubators, or umbrella companies. The essential requirement is your ability to enter into a service agreement and invoice Zoolatech directly. This is not an offer of direct employment.