[Hiring] Senior Application Security Engineer @Treatwell

Role Description

We are hiring a Senior Application Security Engineer to own application security across Product Engineering and make Treatwell's products secure by default. You own the security tooling, from SAST in the pipelines to DefectDojo, you are the first call when an application-layer incident needs a security engineer, and you work hands-on with the teams that build our products:

• Pairing with engineers to fix issues identified by scanners, annual pentests, and real incidents.
• Closing design gaps and sometimes picking up specific security epics for products such as Connect or Salonized.

This is a hands-on role. You will write code, read a great deal more of it, and own the security tooling in our pipelines. Our applications include:

• Java and Spring Boot across Marketplace and Payments
• Ruby on Rails in our SaaS products
• React and TypeScript on the web
• Native iOS and Android apps in Swift and Kotlin
• A small amount of PHP

Marketplace and Connect ship through GitLab CI and ArgoCD onto Kubernetes (EKS) in AWS; Salonized ships through GitHub Actions. Everything is monitored in Datadog, and findings from secrets detection, dependency scanning, and SAST flow into a self-hosted DefectDojo.

This is application security, not infrastructure security: cloud, Kubernetes, and network controls sit with our Developer Experience and Platform Core teams, and you work alongside them. You report to the Head of Developer Experience and set your own security roadmap with the Heads of Engineering, aligned to the OWASP ASVS and the OWASP DevSecOps Maturity Model.

Responsibilities

• Owning application security across Product Engineering and working hands-on with teams to remediate vulnerabilities.
• Owning the security tooling across all areas (secrets detection, dependency scanning, SAST, DefectDojo, threat modelling).
• Making DefectDojo work without a human in the loop.
• Building secure defaults into the paved road.
• Running threat modelling with teams before work is fully scoped.
• Triaging findings from scanners, annual penetration tests, and external reports.
• Being the first security call for application-layer incidents across Product Engineering.
• Owning security vendor relationships.
• Acting as the security reviewer in our third-party risk process.
• Measuring the security posture per area against the DevSecOps Maturity Model.
• Growing the Security Champions programme with the Head of Developer Experience.
• Keeping a short, current security roadmap (Now/Next/Later).

Qualifications

• Experience as an application security engineer or backend engineer with security ownership.
• Ability to read and write production code in at least one of our languages (Java, Ruby, TypeScript).
• Knowledge of the OWASP ASVS and Top 10 from code.
• Experience with SAST, dependency scanning, or secrets detection in CI pipelines.
• Familiarity with vulnerability management platforms.
• Understanding of authentication, sessions, authorisation, and payments flows.
• Knowledge of AWS and Kubernetes.
• Ability to explain risk in plain language.
• Experience with AI tooling for threat modelling and code review.

Nice to have

• Experience in a marketplace, payments, or SaaS business handling card data and personal data under PCI DSS and GDPR.
• A bug bounty, CTF, or penetration-testing background, or an offensive certification such as OSCP, OSWE, or BSCP.
• Experience running or scaling a Security Champions programme.
• Familiarity with the OWASP DevSecOps Maturity Model or another maturity framework.
• Hands-on experience with WAF, bot protection, secrets management, and infrastructure-as-code scanning.
• Knowledge of Spring Security or Rails security internals; writing custom SAST rules.

Benefits

• 28-days holiday, plus bank holidays
• Monthly €40 Treatwell vouchers
• Mental health support through our partnership with Open-Up
• Market-specific benefits discussed in the interview process

Equal Opportunities

Treatwell is an 'Open to All' employer and warmly welcomes everybody to the team. We are committed to making reasonable adjustments to the recruitment process as required. Please add any adjustment requests to your application.