Application Security Engineer - Senior

platacard; United States; Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Relocation with visa support

Flexible work office or remote

Healthcare coverage

Education budget for training

Wellness budget

20 days annual leave

Job summary

platacard is seeking a Senior Application Security Engineer to embed protective controls across the full SDLC. You will bridge development and security, design safeguards, and raise secure coding standards in a technology-driven environment.

You will collaborate with engineering and operations, perform threat modeling and architecture reviews, and lead proactive remediation for web and mobile apps while enabling shift-left security practices across teams.

Qualifications

• Hands-on with web and mobile programming languages.
• Strong knowledge of OWASP Top 10, threat modeling techniques, and security testing frameworks.
• Experience with security tooling: ZAP, Dependency-Track, Burp Suite.
• Certifications like OSCP/OSWE/GWAPT/GCPN are a plus; SaaS/cloud background helpful.

Responsibilities

• Promote secure coding practices and participate in code reviews across SDLC.
• Perform architecture reviews and threat modeling to surface risks early.
• Deploy and maintain SAST/DAST/IAST/RASP and SCA in CI/CD pipelines.
• Lead security incident response, investigation, containment, and hardening.
• Drive shift-left security, enable continuous testing and rapid remediation.
• Conduct workshops on OWASP, ASVS, and secure design standards.

Skills

Web & mobile programming

Microservices

OWASP Top 10

Threat modeling

Security testing frameworks

Tools

ZAP

Dependency-Track

Burp Suite

Job description

Role overview

An Information Security team is hiring a senior Application Security Engineer to embed protective controls across the full software development lifecycle. The role acts as a bridge between development and security, designing safeguards, shaping secure coding culture, and continuously improving application defense practices in a technology-driven environment.

Responsibilities

• Partner with development and operations teams to promote secure coding practices, participate in code reviews, and integrate security into every phase of the SDLC.
• Perform architecture reviews and threat modeling to surface risks early and drive proactive remediation across web and mobile applications.
• Deploy, configure, and maintain automated security tooling (SAST, DAST, IAST, RASP, and SCA) inside CI/CD pipelines so vulnerabilities are caught early.
• Lead response efforts when security incidents occur, including investigation, containment, and post-incident hardening.
• Champion shift-left initiatives by enabling continuous testing, fast remediation loops, and a security-first mindset across engineering.
• Run workshops and training sessions that raise developer awareness of OWASP, ASVS, and secure design standards.

Requirements

• Hands‑on proficiency with web and mobile programming languages.
• Solid grasp of modern web architectures, particularly microservices.
• Deep working knowledge of the OWASP Top 10, threat modeling techniques, and standard security testing frameworks.
• Practical experience with tools such as ZAP, Dependency‑Track, and Burp Suite.
• Strong analytical ability and meticulous attention to detail.

Nice to have

• Industry certifications such as OSCP, OSWE, GWAPT, or GCPN.
• Participation in bug bounty or ethical hacking programs.
• Background in SaaS or cloud‑native environments.
• Familiarity with Kubernetes and container security.

Benefits and work setup

• Relocation assistance with full visa and permit support for the employee and family to several international hubs, including Kazakhstan, Cyprus, Serbia, or Spain.
• Flexible work arrangements with the option to work from an office or remotely.
• Healthcare coverage.
• Education budget covering language lessons, professional training, and certifications.
• Wellness budget reimbursing mental health and fitness activities.
• 20 days of annual leave plus paid sick leave.