pbThis position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Application Security Engineer based in Italy. /b /p pHelp establish and scale a dedicated application security function within a high-growth technology environment where protecting customers against fraud and abuse is a core priority. As a senior individual contributor, you will combine deep security expertise with hands‑on software engineering to identify vulnerabilities, strengthen development workflows, and build practical security tooling. You will design secure software development practices, lead threat modeling and security reviews, and drive vulnerability remediation across complex APIs, SDKs, and cloud‑based systems. Working closely with engineering teams and security leadership, you will integrate AI‑powered tools into security testing and remediation while maintaining rigorous quality standards. This role offers substantial technical autonomy, opportunities to influence engineering practices across the organization, and the chance to solve challenging security problems at scale. You will help make security an integral part of product development rather than a separate compliance requirement. /p h3Accountabilities /h3 ul lipDesign and implement a secure software development lifecycle (SDLC), incorporating security requirements, design-time threat modeling, secure code reviews, and pre-release testing into existing engineering workflows. /p /li lipOwn and improve application security tooling, including static and dynamic application security testing (SAST/DAST), software composition analysis (SCA), dependency scanning, secrets detection, and container and infrastructure‑as‑code scanning. /p /li lipIntegrate security tools into CI/CD pipelines, reduce false positives, establish clear vulnerability ownership and remediation service‑level agreements (SLAs), and ensure findings lead to meaningful action. /p /li lipDevelop an AI‑first security engineering approach using AI‑assisted vulnerability triage, automated remediation, security review agents, and AI‑augmented testing, with evidence‑based controls governing what these tools can flag, block, or fix. /p /li lipBuild reusable security patterns, hardened libraries, and secure defaults for authentication, authorization, input validation, secrets management, and cryptographic operations. /p /li lipContribute directly to production codebases by implementing security fixes, developing security libraries, and building automation and CI integrations. /p /li lipLead threat modeling and architecture security reviews for new products, features, and significant technical changes across APIs, web and mobile SDKs, dashboards, and data pipelines. /p /li lipManage vulnerability identification, risk assessment, prioritization, and remediation for findings from security scanners, penetration tests, bug bounty reports, and customer disclosures. /p /li lipConduct hands‑on security testing, including manual code review and exploitation testing for authentication and authorization weaknesses, API vulnerabilities, injection attacks, server‑side request forgery (SSRF), business‑logic flaws, and abuse scenarios. /p /li lipPay particular attention to adversarial threats involving fraud detection and bot mitigation, identifying weaknesses that could allow attackers to bypass or undermine platform protections. /p /li lipCollaborate with penetration testing and compliance specialists to scope assessments, validate fixes, retest findings,



and translate technical discoveries into actionable engineering work. /p /li lipLead technical investigations of application‑layer security incidents, coordinating containment, root‑cause analysis, remediation, and collaboration with cloud infrastructure teams when necessary. /p /li lipDefine application security logging and alerting requirements and partner with engineering and cloud platform teams to implement effective detection capabilities. /p /li lipSupport engineering teams through security consultations, office hours, secure coding guidance, and a Security Champions program that expands security expertise across the organization. /p /li lipDevelop practical secure coding training based on real application code, vulnerabilities, and lessons learned from security incidents. /p /li lipMentor engineers through code reviews and architecture feedback, helping improve security awareness and engineering quality without relying solely on mandates. /p /li lipPartner with application security leadership to shape technical priorities, communicate findings and risk assessments, and execute initiatives that advance the broader security roadmap. /p /li lipProvide technical evidence for security controls, contribute to vendor security assessments, and support enterprise customer due diligence, security questionnaires, architecture discussions, and penetration testing summaries. /p /li /ul h3Requirements /h3 ul lipAt least 8 years of experience in software engineering and/or security engineering, including 5 or more years focused on application security. /p /li lipExperience building or improving application security programs within a product engineering organization, with a strong emphasis on hands‑on implementation rather than consulting or auditing alone. /p /li lipStrong software engineering fundamentals and the ability to write production‑quality code in TypeScript, JavaScript, Go, Python, or a comparable language. /p /li lipFamiliarity with modern web applications, APIs, software architectures, source code repositories, and CI/CD pipelines. /p /li lipDeep practical application security expertise, including OWASP Top 10 and related vulnerabilities, authentication and authorization design, API security, injection attacks, SSRF, cryptographic misuse, business‑logic flaws, and abuse scenarios. /p /li lipAbility to identify vulnerabilities through manual testing, explain their real‑world impact, and propose practical fixes that engineering teams can implement. /p /li lipDemonstrated experience leading threat modeling and architecture security reviews for complex systems and producing threat models that inform engineering decisions. /p /li lipExperience deploying, configuring, and tuning SAST, DAST, SCA, secrets detection, and related security tooling within CI/CD workflows. /p /li lipPractical experience using AI‑assisted security tools for code analysis, vulnerability triage, or automated remediation in real‑world environments. /p /li lipRegular use of AI agents in security work, with a clear understanding of their limitations, reliability, false‑positive risks, and appropriate level of autonomy.



/p /li lipExperience owning vulnerability management processes, including triage, severity classification, remediation tracking, penetration testing follow‑up, and enforcement of remediation SLAs. /p /li lipProven ability to influence engineering teams through technical credibility, effective collaboration, well‑designed tools, and actionable guidance rather than formal authority alone. /p /li lipExcellent written and verbal communication skills, including the ability to produce precise security findings and explain technical risks to engineers, leadership, and customer security teams. /p /li lipStrong analytical skills, sound technical judgment, and the ability to work independently on ambiguous, multi‑quarter initiatives. /p /li /ul h3Nice‑to‑have qualifications /h3 ul lipExperience in fraud detection, bot mitigation, identity security, or device intelligence. /p /li lipStrong cloud security knowledge, particularly AWS IAM, network boundaries, secrets management, and workload identity. /p /li lipFamiliarity with cloud security posture management tools such as Wiz or equivalent solutions. /p /li lipExperience securing client‑side applications and mobile SDKs, including browser security, anti‑tampering techniques, obfuscation tradeoffs, and iOS or Android SDK hardening. /p /li lipExperience with multi‑tenant SaaS platforms and high‑volume, latency‑sensitive APIs. /p /li lipExperience operating a bug bounty program through platforms such as HackerOne, Bugcrowd, or equivalent services. /p /li lipAwareness of AI and machine learning security risks, including prompt injection, LLM‑integrated features, agent permissions, and model or data‑pipeline vulnerabilities. /p /li lipExperience with autonomous or AI‑augmented penetration testing and attack simulation, including an understanding of how these approaches complement human‑led testing. /p /li lipRelevant security certifications, such as OSCP, OSWE, GWAPT, or CSSLP, or evidence of security research, published CVEs, or open‑source security contributions. /p /li lipExperience implementing or supporting SOC 2 or ISO 27001 controls as the engineering owner responsible for making them operational. /p /li /ul h3Benefits /h3 ul lipAnnual base salary ranging from $177,000 to $240,000, depending on location, experience, and expertise. /p /li lipLocation‑based salary examples include $209,000–$240,000 for New York City and $177,000–$204,000 for Chicago. /p /li lipFully remote work environment, subject to geographic and regulatory restrictions. /p /li lipSignificant technical autonomy and the opportunity to shape the application security function from its early stages. /p /li lipExecutive‑level support for application security initiatives and collaboration with dedicated security leadership. /p /li lipOpportunity to focus on hands‑on engineering, security tooling, vulnerability discovery, and remediation rather than primarily administrative compliance work. /p /li lipAccess to an established security technology environment that includes tools such as Snyk, Wiz, Cloudflare, and Okta. /p /li lipCollaboration with cloud platform, engineering, and compliance specialists who treat security as a shared responsibility. /p /li lipOpportunities to influence enterprise security practices and protect high‑volume systems against sophisticated fraud and abuse threats. /p /li lipAn inclusive, globally distributed working environment that values diverse perspectives and professional contributions. /p /li /ul #J-18808-Ljbffr

📌 Staff Application Security Engineer (Italia)
🏢 Jobgether
📍 Italia