Application Security Engineer - Senior

platacard; United States; Hybrid; USD 140,000 - 180,000; Full time

Benefits offered by this job

Relocation & visa support

Flexible work options

Healthcare coverage

Education budget

Wellness budget

20 days annual leave + sick leave

Job summary

platacard is seeking a Senior Application Security Engineer to embed protective controls across the full software development lifecycle. You will bridge development and security, designing safeguards and shaping secure coding culture.

You will drive threat modeling, implement CI/CD security tooling (SAST/DAST/IAST/RASP/SCA), lead incident response, and run OWASP/ASVS training to raise developer awareness.

Qualifications

• Hands-on experience with web and mobile programming languages.
• Deep knowledge of modern web architectures, especially microservices.
• Practical knowledge of OWASP Top 10, threat modeling, and security testing frameworks.

Responsibilities

• Promote secure coding in the SDLC and participate in code reviews.
• Perform architecture reviews and threat modeling to surface risks.
• Deploy and maintain automated security tooling in CI/CD pipelines.
• Lead security incident response, containment and post-incident hardening.
• Champion shift-left and security-first mindset across engineering.
• Run workshops on OWASP, ASVS and secure design standards.

Skills

Web & mobile programming

Microservices

OWASP Top 10

Threat modeling

Security testing

Analytical

Tools

ZAP

Dependency-Track

Burp Suite

Job description

Role overview

An Information Security team is hiring a senior Application Security Engineer to embed protective controls across the full software development lifecycle. The role acts as a bridge between development and security, designing safeguards, shaping secure coding culture, and continuously improving application defense practices in a technology-driven environment.

Responsibilities

• Partner with development and operations teams to promote secure coding practices, participate in code reviews, and integrate security into every phase of the SDLC.
• Perform architecture reviews and threat modeling to surface risks early and drive proactive remediation across web and mobile applications.
• Deploy, configure, and maintain automated security tooling (SAST, DAST, IAST, RASP, and SCA) inside CI/CD pipelines so vulnerabilities are caught early.
• Lead response efforts when security incidents occur, including investigation, containment, and post-incident hardening.
• Champion shift-left initiatives by enabling continuous testing, fast remediation loops, and a security-first mindset across engineering.
• Run workshops and training sessions that raise developer awareness of OWASP, ASVS, and secure design standards.

Requirements

• Hands-on proficiency with web and mobile programming languages.
• Solid grasp of modern web architectures, particularly microservices.
• Deep working knowledge of the OWASP Top 10, threat modeling techniques, and standard security testing frameworks.
• Practical experience with tools such as ZAP, Dependency-Track, and Burp Suite.
• Strong analytical ability and meticulous attention to detail.

Nice to have

• Industry certifications such as OSCP, OSWE, GWAPT, or GCPN.
• Participation in bug bounty or ethical hacking programs.
• Background in SaaS or cloud-native environments.
• Familiarity with Kubernetes and container security.

Benefits and work setup

• Relocation assistance with full visa and permit support for the employee and family to several international hubs, including Kazakhstan, Cyprus, Serbia, or Spain.
• Flexible work arrangements with the option to work from an office or remotely.
• Healthcare coverage.
• Education budget covering language lessons, professional training, and certifications.
• Wellness budget reimbursing mental health and fitness activities.
• 20 days of annual leave plus paid sick leave.