Application Security Engineer Central Europe

Zoolatech; Central (LA); On-site; USD 120,000 - 180,000; Full time

Job summary

Zoolatech in collaboration with a leading European Online Fashion & Beauty Retailer seeks an experienced Application Security Engineer to secure modern cloud-native applications. You will drive threat modeling, architecture reviews, and secure design decisions across engineering teams.

You’ll validate AI-assisted threat modeling, recommend mitigations, and ensure robust API/authentication security. Familiarity with OWASP Top 10 for Web Apps and LLMs is a plus.

Qualifications

• 5–10 years of professional experience in Application Security.
• Hands-on threat modeling using STRIDE or similar methodologies.
• Experience reviewing AI-assisted threat modeling outputs.
• Security architecture and design review expertise.
• Strong knowledge of OWASP Top 10 for Web Apps and REST API security.
• Experience with OAuth 2.0/2.1, OpenID Connect, JWT/JWS/JWE, mTLS, SAML.

Responsibilities

• Conduct structured threat modeling for web and other apps using STRIDE.
• Review AI-assisted threat modeling outputs and close gaps with actionable guidance.
• Perform security architecture reviews to surface risks early.
• Recommend secure design patterns and practical mitigations.
• Assess authentication, API security, tokens, and secrets handling.
• Collaborate with engineers to embed security into design and dev work.
• Provide developer-friendly guidance on security controls and remediation.
• Evaluate security risks in AI/LLM-based apps and architectures.
• Apply OWASP standards and best practices for web and LLM security.

Skills

Threat modeling

OWASP Top 10

Cloud security

OAuth 2.0

JWT/JWS/JWE

RBAC/ABAC

Open Policy Agent

Rego

Tools

Open Policy Agent (OPA)

Rego

Cedar

Job description

Are you passionate about application security and helping engineering teams build secure, resilient applications? We are collaborating with a leading European Online Fashion & Beauty Retailer to find a highly capable and self-driven Application Security Engineer to support its growing security needs.

This role is centered around threat modeling, application security architecture, and technical design reviews. You’ll work closely with software engineers and architects to identify potential security risks, validate AI-assisted threat modeling results, and provide practical, actionable recommendations to strengthen application security across the organization. You’ll also have the opportunity to contribute to securing AI-powered solutions and modern cloud-native applications.

Responsibilities

Conduct structured threat modeling for web applications and other application types, using established methodologies such as STRIDE.

Review and validate threat modeling outputs generated by AI-assisted tools, identifying potential gaps and providing actionable security recommendations.

Perform application security architecture and technical design reviews to identify security risks early in the development lifecycle.

Recommend secure design patterns and practical mitigation strategies for application security risks.

Review and advise on authentication and authorization mechanisms, API security, token management, and secrets handling.

Collaborate closely with software engineers and architects to integrate security best practices into application design and development.

Provide clear, developer-friendly guidance on implementing security controls and remediating identified risks.

Assess security risks in AI/LLM-based applications and architectures, providing recommendations to help teams develop secure AI-powered solutions.

Apply relevant security standards and best practices, including OWASP Top 10 for Web Applications and OWASP Top 10 for LLM Applications.

Requirements

5–10 years of professional experience in Application Security

Strong hands-on experience with manual threat modeling and threat modeling methodologies such as STRIDE.

Experience reviewing and validating AI-assisted or automated threat modeling outputs.

Proven experience in application security architecture and technical design reviews.

Strong understanding of secure software design principles, security controls, and risk mitigation strategies.

Good knowledge of OWASP Top 10 for Web Applications and REST API security best practices.

Experience with modern authentication and authorization protocols, including OAuth 2.0/2.1, OpenID Connect (OIDC), JWT/JWS/JWE, mTLS, and SAML.

Understanding of authorization models such as RBAC and ABAC, as well as policy-as-code approaches and tools like Open Policy Agent (OPA), Rego, or Cedar.

Familiarity with modern cloud-native application architectures and common backend technologies.

Ability to communicate security risks clearly and provide practical, actionable recommendations to software engineers and architects.

Strong analytical and problem-solving skills, with the ability to work independently and collaborate effectively with cross-functional teams.

Nice to Have:

Experience with AI/LLM application security and knowledge of the OWASP Top 10 for LLM Applications.

Familiarity with IDE or CI/CD integrations and automated or LLM-assisted threat modeling tools.

Experience assessing the security of AI-powered solutions and reviewing AI system architectures.

South Georgia and the South Sandwich Islands

South Korea

Spain

Spratly Islands

Sri Lanka

Sudan

Sweden

Syria

Togo

Tonga

Tromelin Island

Tunisia

Turkey

Turkmenistan

Turks and Caicos Islands

Uganda

Ukraine

United Arab Emirates

United Kingdom

United States

Uruguay

Vanuatu

Vatican City

Vietnam

Virgin Islands

Wake Island

Wallis and Futuna

West Bank

Western Sahara

Yemen