Application Security Engineer

• We're looking for an exceptional Application Security Engineer to strengthen the security of our applications, platforms, APIs, and development processes.
• This is an opportunity for a technically strong security professional who understands how modern applications are built, how vulnerabilities emerge, and how to prevent security risks before they reach production.

Role Overview

• The Application Security Engineer will be responsible for embedding security throughout the software development lifecycle, identifying and mitigating vulnerabilities, conducting security assessments, and collaborating with engineering teams to build secure, resilient applications.

Key Responsibilities

Application Security & Secure Development:

• Design, implement, and maintain secure application development standards and guidelines.
• Integrate security practices into the Software Development Life Cycle (SDLC).
• Conduct application security reviews across web applications, mobile applications, and APIs.Identify, assess, prioritise, and remediate security vulnerabilities.
• Establish secure coding practices across engineering teams.
• Review application architecture and technical designs for security risks.

Security Testing & Vulnerability Management:

• Perform penetration testing, vulnerability assessments, and security testing.
• Conduct code reviews focused on security vulnerabilities.
• Identify risks including SQL injection, XSS, CSRF, SSRF, broken authentication, insecure authorisation, and API vulnerabilities.
• Manage vulnerability tracking, remediation, and verification.
• Utilise tools such as SAST, DAST, SCA, and secrets scanning solutions.
• Support security testing before major product releases.

DevSecOps & Infrastructure Security:

• Integrate automated security checks into CI/CD pipelines.
• Collaborate with DevOps engineers to secure cloud infrastructure, containers, and deployment environments.
• Implement dependency scanning, container security, and secrets management practices.
• Support security monitoring, incident response, and remediation.
• Strengthen security configurations across development, staging, and production environments.

Security Architecture & Compliance:

• Develop security requirements for applications, APIs, and integrations.
• Apply security frameworks and best practices, including OWASP Top 10 and OWASP ASVS.
• Support compliance requirements relating to ISO 27001, SOC 2, and relevant data protection regulations.
• Develop security documentation, risk assessments, and remediation reports.
• Advise engineering teams on secure authentication, encryption, identity management, and access controls.

Engineering Collaboration:

• Work closely with Software Engineers, Product Managers, DevOps Engineers, and technical leadership.
• Provide practical security guidance during development and code reviews.
• Conduct security awareness sessions for engineering teams.
• Champion security as an engineering responsibility rather than a final-stage checklist.

Key Deliverables:

• Secure application architecture and development standards.
• Regular application security assessments and vulnerability reports.
• Security-integrated CI/CD pipelines.
• Improved vulnerability remediation turnaround.Secure APIs, authentication systems, and application integrations.
• Documented security controls and risk mitigation strategies.
• Reduced application security incidents and recurring vulnerabilities.

Requirements

• 4 - 7+ years of experience in Application Security, Product Security, DevSecOps, or a closely related cybersecurity role.
• Strong understanding of web application security, API security, and modern application architectures.
• Practical experience conducting penetration testing and vulnerability assessments.
• Strong knowledge of OWASP Top 10, OWASP API Security Top 10, and secure coding principles.
• Experience with SAST, DAST, SCA, and security testing tools.
• Familiarity with Node.js, JavaScript/TypeScript, Python, or other modern programming languages.
• Experience securing REST APIs, authentication systems, databases, and third-party integrations.
• Understanding of cloud security, Docker, Kubernetes, and CI/CD pipelines.
• Familiarity with Git-based development workflows and automated security testing.
• Strong analytical, documentation, and problem-solving skills.

Nice to Have:

• Relevant certifications such as OSCP, OSWE, GWAPT, CSSLP, or equivalent.
• Experience with AWS, Azure, or Google Cloud security.
• Knowledge of threat modelling methodologies such as STRIDE.
• Experience with bug bounty programmes or responsible vulnerability disclosure.
• Familiarity with security standards including ISO 27001, SOC 2, and PCI DSS.
• Experience supporting security reviews for SaaS platforms or enterprise applications.

The Ideal Candidate:

• You are a security-minded engineer who understands both offensive and defensive security.
• You can identify weaknesses, explain risks clearly, and work constructively with developers to implement practical solutions.
• You don't just find vulnerabilities you help engineering teams build systems that are secure by design.

Why Join Strivolabs?

• Work on diverse digital products, platforms, and technology solutions.
• Collaborate with a growing multidisciplinary engineering team.
• Influence security architecture and engineering standards.
• Contribute to building secure, scalable digital infrastructure.
• Grow within an ambitious technology and digital execution company.