application security engineer

Steampunk

<div>Overview:
<div>
As a <b>Web Application Security Engineer</b>, you will provide technical expertise and solutions to remediate persistent and challenging portfolio-wide vulnerabilities. We&rsquo;re looking for someone who has passion for IT, resourceful problem-solving abilities, and a desire to learn our indicators of success in this role. The ideal candidate will have a breadth of experience over a variety of application and web based technologies. The candidate will not necessarily have deep experience in all domain areas but should have a good understanding of how the various layers of an enterprise application stack interact with one another. You will work directly with system admin teams to assist and remediate vulnerabilities and harden environments, while providing recommendations on ways to enhance vulnerability management. Additionally, you will work in a team environment to develop proactive solutions to improve overall enterprise security posture through process streamlining and automation.</div>
Contributions:
<div><b>
Responsibilities include:</b></div><br>
<div></div><ul><li>
Provide subject matter expertise for various risk assessments, working in an Agile environment with an understanding of the full software development lifecycle.</li><li>
Advocate for and ensure appropriate security practices are communicated and implemented within application development portfolios.</li><li>
Ability and proven experience in securing multiple areas of an enterprise application stack, including the OS, Database, Application Server, Load Balancer, and Web Server layers. Understanding how PKI/TLS certificates work is a must.</li><li>
Integrate with both the application development and security assurance divisions to ensure vulnerability findings are understood, remediated or baselined as appropriate.</li><li>
Document &amp; Socialize security findings and remediation solutions in an enterprise knowledge base.</li><li>
Support the Information Assurance Branch and the SOC with scan analysis and partner with development teams to understand and remediate security findings.</li></ul>
Qualifications:
<div><b>
Required:</b></div><br>
<div></div><ul><li>
Ability to obtain a U.S. government Security Clearance</li><li>
Master's Degree and 3 years of relevant experience; OR<ul><li>
Bachelor's Degree and 5 years of relevant experience; OR</li><li>
No degree and 9 years of relevant experience</li></ul></li><li>
Possesses at least one professional certification relevant to the technical service provided. Maintain a certification relevant to the product being deployed and/or maintained.</li></ul><div></div><div><b><br>
Preferred:</b></div><br>
<div></div><ul><li>
Former Developer or Systems Administrator experience</li><li>
Working knowledge of technologies used for building and deploying enterprise applications, such as, Maven, Grade, GIT, Jenkins, Ansible, Java, C#/.NET, Apache Tomcat, Apache HTTP Server, IIS, F5, Oracle, MSSQLSEVER, PostGres</li><li>
Working knowledge and experience in AWS and Azure GovClouds</li><li>
Ability to analyze DISA STIG audit compliance scan results and provide recommendations for resolution</li><li>
Analyze security environment, provide recommendations</li><li>
Working knowledge of JIRA, Service Now or equivalent</li><li>
Working knowledge of operating system and dynamic application security testing scan tools &ndash; Invicti, Web Inspect, DAST/IAST suites</li><li>
Experience using Python to automate tasks</li></ul><div></div><div><b><br>
Certifications:</b></div><br>
<div></div><ul><li>
CEH, GFACT, GPEN, OSCP or other relevant industry certifications</li><li>
Other Application based Technology specific certifiations</li></ul>
About <b>steampunk</b>:
<div>
Steampunk relies on several factors to determine salary, including but not limited to geographic location, contractual requirements, education, knowledge, skills, competencies, and experience. The projected compensation range for this position is $100,000 to $155,000. The estimate displayed represents a typical annual salary range for this position. Annual salary is just one aspect of Steampunk&rsquo;s total compensation package for employees. Learn more about additional Steampunk benefits here.</div><div></div><div><b><br>
Identity Statement</b></div><div>
As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.</div><div></div><div><br>
Steampunk is a <b>Change Agent</b> in the Federal contracting industry, bringing new thinking to clients in the Homeland, Federal Civilian, Health and DoD sectors. Through our <b>Human-Centered delivery methodology</b>, we are fundamentally changing the expectations our Federal clients have for true shared accountability in solving their toughest mission challenges. As an <b>employee owned company</b>, we focus on investing in our employees to enable them to do the greatest work of their careers &ndash; and rewarding them for outstanding contributions to our growth. If you want to learn more about our story, visit http://www.steampunk.com.</div><div></div><div><i><br>
We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by law. Steampunk participates in the E-Verify program.</i></div></div>

Web Application Security Engineer

Holland & Barrett International Limited

<p>About the role:</p> <p>At Holland & Barrett, cybersecurity is at the heart of our digital transformation. As we continue to grow and innovate, securing our applications and protecting customer data is a top priority. We are looking for a <strong>Senior Application Security Engineer</strong> to lead our efforts in strengthening application security, mitigating risks, and ensuring best-in-class security practices. If you are passionate about cybersecurity and eager to make a real impact, we want you on our team!</p> <p><strong>Key Responsibilities:</strong></p> <ul> <li><strong>Security Strategy:</strong> Help define and execute the Holland & Barrett application security strategy. Collaborate with both tech and non-tech teams to integrate security principles into the early stages of product design and development.</li><li><strong>Secure SLDC:</strong> Establish a secure Software Development Lifecycle (SDLC) that enables development teams to deliver high-quality applications quickly while implementing essential controls for software integrity, authenticity, and third-party library management.</li><li><strong>Risk Assessments:</strong> Conduct risk assessments, threat modeling, and architecture reviews alongside development teams, producing artifacts to drive the implementation of effective security controls.</li><li><strong>Standards Development:</strong> Own the creation and maintenance of tailored security standards and guidelines, developing reusable resources for various development teams.</li><li><strong>Team Support:</strong> Provide guidance and support to development teams on secure software production practices and flaw mitigation strategies.</li></ul> <p>Key requirements:</p> <p><strong>Essential:</strong></p> <ul> <li>5+ years of experience in application security, with at least 3+ years in software development.</li><li>Strong understanding of application security concepts, including secure coding practices, threat modeling, vulnerability management, and access control mechanisms.</li><li>Experience with AWS, Kubernetes, Service Mesh, and API Security (including authentication and authorization).</li><li>Proficiency in programming languages such as Python, Java, JavaScript, GoLang, and Rust.</li><li>Familiarity with Agile methodologies like SCRUM, along with proven project management skills to oversee multiple security projects simultaneously.</li></ul> <p><strong>Desired:</strong></p> <ul> <li>Independent, proactive, and detail-oriented, with a commitment to maintaining high security standards.</li><li>Strong communication and interpersonal skills, facilitating effective collaboration with both technical and non-technical teams.</li></ul> <p>What we offer:</p> <p><strong>What we offer:</strong></p> <p><strong>Wellbeing & Lifestyle Benefits</strong> </p> <ul> <li>Health Cash Plan </li><li>Life Assurance</li><li>Incentive Scheme - Based on company & personal performance</li><li>Virtual GP </li><li>Private Medical care</li><li>FREE at-home blood test kit </li><li>Holiday Purchase option </li><li>Pension Contribution scheme</li><li>Access to 'Wellhub' with gyms, studios and wellbeing apps </li></ul> <p><strong>Discounts & Savings</strong> </p> <ul> <li>25% Colleague Discount with FREE Next Day Delivery </li><li>Exclusive Discounts from a wide range of partners </li><li>£/€50 Annual Product Allowance to spend in store </li></ul> <p><strong>Learning & Development</strong> </p> <ul> <li>Access to a variety of learning opportunities, including Level 2-5 Apprenticeships, Workshops and our Digital Learning Library </li><li>AND MORE! </li></ul> <p>Our culture respects equality, values diversity and encourages individuality - because this allows our people to unlock their potential and be their best. We welcome everyone who shares our EPIC values regardless of background, culture, disability, ethnicity, gender identity or sexual orientation</p> <p>Holland & Barrett does not accept unsolicited resumes from search firms/recruiters. Please do not forward resumes to our job alias, employees, or any other company location. Holland & Barrett is not and will not be responsible for any fees if a candidate submitted by a search firm/recruiter unless otherwise agreed with respect to specific open position(s).</p>

Senior Application Security Engineer

Bayut.com

<p><br></p> <p> <strong>In this role you will:</strong> </p> <ul> <li>Collaborate with internal teams to implement security controls, address vulnerabilities and improvesecurity practices in the relevant platforms &amp; services.</li> <li>Conduct penetration testing on web applications, mobile applications, APIs, networks, and system and coordinate the pen-testing projects executed by external partners.</li> <li>Ensure identified vulnerabilities, threats and risks are captured and processed in line with our risk management policy and procedure.</li> <li>Take part in security incident resolution and contribute to the development, maintenance and assessment of the Incident Response Plan s effectiveness.</li> <li>Monitor the internal alerting systems and drive the events to closure.</li> <li>Participate in regular internal and external audits (including periodic user access reviews) on critical systems and ensure audit findings are remediated in the agreed timeframe.</li> <li>Reduce the information security knowledge gap within the technical teams by contributing to the creation of educational materials and awareness campaigns.</li> <li>Implement and regularly review the internal security policies and controls across all business-critical services.</li> </ul> <p> </p>

Application Security Engineer

Work Generations Pvt Ltd

<p><b>Work Generations pvt ltd</b><br/><b>Job Title: </b>Cybersecurity Developer</p><p><b>Timing 4pm-12am</b><br/><b>Location: Bahria Intellectual Village, Phase 7 Bahria Town, Rawalpindi</b></p><p><b>Role Overview:</b></p><p>A <b>Cybersecurity Developer</b> (also called <b>Security Software Developer</b> or <b>Application Security Engineer</b>) designs, builds, and maintains secure software systems. Their role combines <b>software development</b> and <b>cybersecurity practices</b> to prevent, detect, and respond to security vulnerabilities in code and applications.</p><p><b>Key Responsibilities</b></p><ul><li><b>Secure Software Development</b></li><li>Write and review secure code following best practices (e.g., OWASP Top 10).</li><li>Integrate security into SDLC (Secure Development Life Cycle).</li><li>Develop tools to automate security testing and monitoring.</li><li><b>Threat Modeling &amp; Risk Assessment</b></li><li>Identify potential threats and vulnerabilities in applications.</li><li>Perform security assessments during design and development stages.</li><li><b>Vulnerability Management</b></li><li>Conduct code reviews and penetration testing.</li><li>Patch or mitigate discovered vulnerabilities.</li><li><b>Security Tool Development</b></li><li>Build or customize security tools (e.g., intrusion detection, log analysis, vulnerability scanners).</li><li>Develop APIs or automation scripts to integrate security solutions.</li><li><b>Collaboration</b></li><li>Work with DevOps, QA, and IT teams to ensure secure deployment.</li><li>Educate developers about secure coding standards.</li><li><b>Incident Response Support</b></li><li>Assist in analyzing and mitigating application-level attacks.</li><li>Develop patches or updates after incidents.</li></ul><p><b>Required Skills</b></p><ul><li><b>Programming Languages:</b> Python, Java, C/C++, Go, or JavaScript.</li><li><b>Security Frameworks:</b> OWASP, NIST, ISO 27001.</li><li><b>Tools:</b> Burp Suite, Metasploit, Wireshark, Nessus, or custom-built tools.</li><li><b>Concepts:</b> Cryptography, authentication, network protocols, threat modeling, secure APIs.</li><li><b>DevOps Security:</b> CI/CD pipeline hardening, container security (Docker/Kubernetes).</li></ul><p><b>Qualifications</b></p><ul><li><b>Education:</b> Bachelor&rsquo;s in Computer Science, IT, or Cybersecurity.</li><li><b>Certifications (optional but valued):</b></li><li>CEH (Certified Ethical Hacker)</li><li>CompTIA Security+</li><li>OSCP (Offensive Security Certified Professional)</li><li>CSSLP (Certified Secure Software Lifecycle Professional)</li></ul><p>Job Type: Full-time</p><p>Work Location: In person</p>

Cybersecurity Developer

SAVE IN GOLD

<p>Job Title: Cyber Security Engineer (Mobile &amp; Web Trading Apps)</p><p>Location: Dubai, UAE</p><p>Employment Type: Full-time / On-site</p><p>Experience: 3&ndash;6 years</p><p>We are looking for a Cyber Security Engineer to help secure our mobile and web trading applications.</p><p>The ideal candidate will have deep knowledge of ethical hacking, fintech app security, and experience testing real-world trading and payment flows.</p><p>Key Responsibilities</p><p>Perform security testing (VAPT) for mobile and web trading applications</p><p>Identify and fix vulnerabilities such as data leaks, weak authentication, and insecure APIs</p><p>Conduct manual and automated penetration testing including business logic and workflow attacks</p><p>Test trading-specific flows for issues like order manipulation, replay attacks, race conditions, and incorrect settlements</p><p>Test API endpoints for unauthorized access, missing rate limits, and parameter tampering</p><p>Test mobile apps for jailbreak/root bypass, insecure data storage, and certificate pinning bypass</p><p>Review code and configurations for encryption, authentication, and transaction logic risks</p><p>Validate transaction integrity and secure wallet operations</p><p>Prepare clear, detailed security reports with risk levels and actionable recommendations</p><p>Collaborate with developers, QA, and backend teams to ensure secure fixes</p><p>Ensure compliance with secure coding practices, OWASP, ISO 27001, and fintech data protection standards</p><p>Test for fraud and abuse scenarios including bot automation, fake orders, and session hijacking</p><p>Validate key management, encryption (in transit &amp; at rest), and use of HSM or cloud key vaults</p><p>Verify logging and alerting for suspicious transactions and security incidents</p><p>Stay updated on latest hacking tools, mobile/web attack trends, and financial app threats</p><p>Required Skills</p><p>Strong understanding of mobile (Android/iOS) and web app security</p><p>Hands-on with Burp Suite, ZAP, Postman, Nmap, MobSF, Frida, or similar tools</p><p>Good understanding of OWASP Top 10, API security, SAST/DAST, and vulnerability analysis</p><p>Experience testing trading, wallet, and payment flows</p><p>Knowledge of attacks like replay, race condition, spoofing, and injection</p><p>Familiar with cryptography and key management (HSM/KMS)</p><p>Experience with anti-bot, rate-limiting, and session management controls</p><p>Strong report writing and communication skills</p><p>Team player who collaborates well with developers and testers</p><p>Experience in fintech or banking is highly preferred</p><p>Qualifications</p><p>Bachelor&rsquo;s or Master&rsquo;s in Computer Science, IT, or Cybersecurity</p><p>Certifications: CEH, OSCP, ISO 27001, or equivalent preferred</p><p>3+ years of experience in penetration testing and application security</p><p>Based in UAE</p><p>Job Type: Full-time</p><p>Pay: AED5,000.00 - AED7,000.00 per month</p>

Cyber Security Engineer

Capital Group

<div></div><div><div>&ldquo;I can succeed as an AI AppSec Engineer V at Capital Group&rdquo;</div><div></div><div>
As an AI AppSec Engineer, you will work with application teams to ensure the security of custom and procured AI solutions. You will help enable Capital Group&rsquo;s AI strategy by building and/or procuring solutions to protect a diverse set of enterprise AI platforms being built and deployed at Capital Group. You&rsquo;ll collaborate with platform engineering, security engineering, and risk teams to ensure their solutions support scalable, secure adoption of AI.</div><div></div><div>
Additionally, you&rsquo;ll be expected to provide mentoring, advising diverse teams across the organization, and promoting AI Security principles across Capital Group.</div><div></div><ul><li>
Secure AI Development Lifecycle: You will procure and/or build technical solutions to embed automated security checks into the AI SDLC and ML-Ops.</li><li>
AI Threat Modeling: You will threat model complex Agentic and AI systems and design security requirements collaboratively with developers, architects and business stakeholders</li><li>
Code analysis: You will review code for security vulnerabilities in the context of AI-driven systems</li><li>
Contribute to Standards and Policies: You will provide thought leadership for Information Security policies and standards for AI in collaboration with technology risk</li><li>
AI/Agent SME: You will provide AI/Agent subject matter expertise for AI Incidents and Security Reviews, and help develop incident response playbooks for AI-related security incidents</li></ul><div></div><div>
&ldquo;I am the person Capital Group is looking for.&rdquo;</div><div></div><ul><li>
You have 8+ years of experience in information security, application security, platform security, or penetration testing, DevSecOps, network security and other security disciplines.</li><li>
You have strong knowledge of security of safety risks of Large Language Models and AI Agents (OWASP for LLM Top 10, etcetera)</li><li>
You have 5+ Years of experience automating security checks, including SAST, SCA, and DAST, directly into CI/CD pipelines</li><li>
You have extensive experience with STRIDE/other threat modeling frameworks, agile workflows,<br>
including Scrum and Kanban</li><li>
You are experienced in at least one programming languages (Python, Java, .NET)</li><li>
You can effectively partner and collaborate with stakeholder teams.</li><li>
You have effective communication skills and the ability to outline security risks to leadership.</li></ul><div></div><div>
Preferred Qualifications:</div><ul><li>
You have knowledge and experience with technologies including Kubernetes, Containers, CI/CD, and Cloud Service Providers</li><li>
You are familiar with function and purpose of key AI platform components such as AI gateways (Kong, Databricks Mosaic AI Gateway, custom API orchestration), Model Orchestration (Examples LangChain, LlamaIndex, etc.)</li><li>
You are familiar with key AI regulatory frameworks such as NIST AI RMF, MITRE ATLAS, GDPR, EU AI Act, etc</li><li>
You have Information Security certifications (CISSP, SANS G</li></ul><div><br>
</div>Southern California Base Salary Range: $173,211-$277,138<div><br>
</div>San Antonio Base Salary Range: $142,394-$227,830<div><br>
</div><div></div>New York Base Salary Range: $183,613-$293,781<div><br>
</div><div></div><div><i>In addition to a highly competitive base salary, per plan guidelines, restrictions and vesting requirements, you also will be eligible for an individual annual performance bonus, plus Capital&rsquo;s annual profitability bonus plus a retirement plan where Capital contributes 15% of your eligible earnings.</i></div><div></div><div><i>
You can learn more about our compensation and benefits </i><div><i>here</i></div><i>.</i></div><div></div><ul><li><i>Temporary positions in Canada and the United States</i><i> are excluded from the above mentioned compensation and benefit plans.</i></li></ul><div><i><br>
We are an equal opportunity employer, which means we comply with all federal, state and local laws that prohibit discrimination when making all decisions about employment. As equal opportunity employers, our policies prohibit unlawful discrimination on the basis of race, religion, color, national origin, ancestry, sex (including gender and gender identity), pregnancy, childbirth and related medical conditions, age, physical or mental disability, medical condition, genetic information, marital status, sexual orientation, citizenship status, AIDS/HIV status, political activities or affiliations, military or veteran status, status as a victim of domestic violence, assault or stalking or any other characteristic protected by federal, state or local law.</i></div></div>

AI AppSec Engineer V

<p><b>Job Title: Cyber Security Engineer (Mobile &amp; Web Trading Apps)</b></p><p><b>Location: Dubai, UAE</b></p><p><b>Employment Type: Full-time / On-site</b></p><p><b>Experience: 3&ndash;6 years</b></p><p>We are looking for a Cyber Security Engineer to help secure our mobile trading apps, admin panel, backend services, and APIs.</p><p>The ideal candidate will have deep knowledge of ethical hacking, fintech app security, and experience testing real-world trading and payment flows.</p><p><b>Key Responsibilities</b></p><ul><li>Mobile App Security (Android/iOS)</li><li>Perform VAPT for mobile trading applications.</li><li>Test for jailbreak/root bypass, insecure storage, SSL pinning bypass.</li><li>Identify insecure API usage, data leaks, weak authentication, and session flaws.</li></ul><p><b>Admin Panel / Web Application Security</b></p><ul><li>Perform penetration testing on admin panel and web dashboards.</li><li>Identify vulnerabilities such as privilege escalation, weak access controls, and session hijacking.</li><li>Test business logic flows for fraud, unauthorized actions, and workflow manipulation.</li></ul><p><b>Backend &amp; API Security</b></p><ul><li>Test backend services and APIs for unauthorized access, broken authentication, and parameter tampering.</li><li>Check for missing rate limits, replay attacks, injection flaws, and insecure configurations.</li><li>Validate transaction integrity, trade execution logic, and wallet operations.</li></ul><p><b>Trading Platform Security</b></p><ul><li>Test trading-specific flows for:</li><li>Order manipulation</li><li>Replay attacks</li><li>Race conditions</li><li>Incorrect settlement issues</li><li>Evaluate fraud and abuse scenarios including bots, fake orders, and automation attacks.</li></ul><p><b>General Security Responsibilities</b></p><ul><li>Conduct manual and automated penetration testing.</li><li>Review code/configuration for encryption, authentication, and secure communication.</li><li>Validate encryption at rest/in transit and key management (HSM/KMS).</li><li>Prepare detailed vulnerability reports with severity and recommendations.</li><li>Work closely with development, QA, and backend teams for secure fixes.</li><li>Ensure compliance with OWASP, ISO 27001, secure coding, and fintech security standards.</li><li>Verify security logging, monitoring, and alerting for suspicious activities.</li><li>Stay updated on latest hacking tools and threat trends for mobile, web, and backend systems.</li></ul><p><b>Required Skills</b></p><ul><li>Strong understanding of mobile app security, admin panel/web security, and backend/API security.</li><li>Hands-on experience with Burp Suite, ZAP, Postman, Nmap, MobSF, Frida, or similar tools.</li><li>Good understanding of OWASP Top 10, Mobile Top 10, API Security Top 10, SAST/DAST.</li><li>Experience with trading, wallet, and payment flows.</li><li>Knowledge of replay attacks, race conditions, spoofing, injection, and logic flaws.</li><li>Familiar with cryptography and HSM/KMS key management.</li><li>Experience with anti-bot, rate limits, and session management.</li><li>Strong communication and reporting skills.</li><li>Fintech or banking experience is highly preferred.</li></ul><p><b>Qualifications</b></p><ul><li>Location: Dubai, UAE</li><li>Employment Type: Full-time / On-site</li><li>Experience: 3&ndash;6 years</li></ul><p>Job Type: Full-time</p><p>Pay: AED4,000.00 - AED6,000.00 per month</p>

Cyber Security Engineer (Mobile App • Admin Panel • Backend & API – Trading Apps)

Search 10000+ Application security engineer jobs near you this November. New roles added regularly across leading industries. Apply today.