[Hiring] Application Security Engineer @CCBill

Role Description

We are seeking an Application Security Engineer to support the secure development of internally developed applications. The successful candidate will perform application security testing, code reviews, threat modelling, and vulnerability assessments while supporting the integration of security controls into the software development lifecycle.

The role will work closely with the development, architecture, and Information Security team to identify and remediate security risks and improve the overall security posture of applications.

Qualifications

• Minimum 3 years of experience in application security, penetration testing, software development, or a related information security role.
• Experience performing web application security assessments and penetration testing.
• Understanding of secure software development practices.
• Experience reviewing source code and identifying common security vulnerabilities.
• Strong knowledge of:
  • OWASP Top 10
  • CWE
  • NIST security guidance
  • Secure coding principles
• Knowledge of web technologies, APIs, databases, and networking concepts.
• Familiarity with programming languages such as:
  • Java
  • .NET/C#
  • Python
  • JavaScript
  • Perl
• Understanding authentication, authorization, and session management concepts.

Requirements

• Perform manual and automated security assessments of web applications and APIs.
• Conduct application penetration testing to identify vulnerabilities, security weaknesses, and configuration issues.
• Document findings, remediation recommendations, and risk ratings in clear technical reports.
• Validate remediation activities through re-testing.
• Participate in threat modelling exercises and security design reviews.
• Perform security-focused source code reviews of internally developed applications.
• Support developers in understanding and remediating identified vulnerabilities.
• Promote secure coding practices and security awareness across development teams.
• Support the implementation and operation of security testing within CI/CD pipelines.
• Assist with the deployment and tuning of:
  • Static Application Security Testing (SAST)
  • Dynamic Application Security Testing (DAST)
  • Software Composition Analysis (SCA)
  • Secrets detection controls
• Contribute to security automation initiatives using Jenkins, GitLab, and Bitbucket.
• Track and manage vulnerabilities identified during security testing activities.
• Work with development teams to prioritize and remediate findings.
• Assist in assessing application security risks and recommending appropriate mitigation measures.
• Work closely with development, architecture, infrastructure, and Information Security teams to improve application security.
• Support security reviews prior to production deployments.
• Contribute to the continuous improvement of application security standards, processes, and procedures.

Benefits

• Fully remote work.
• Working hours: Monday to Friday (40 hours); 1PM-9PM CET.