Overview As AppSec Lead, you establish and drive our Application Security program within Product & Technology. You'll evangelize AppSec, work with engineers and product managers to design secure products, and own the training and Security Champions initiatives to scale DevSecOps. You will integrate security into the SDLC, guide secure design and coding practices, and manage vulnerability lifecycle across internal and external apps. You'll stay ahead of AI/LLM security trends and contribute to incident reviews and security playbooks.

Retribuzione / Benefits

Flexi-Week with four-day structure

Hybrid/remote working setup

Monthly work expense allowance and home office furniture package

Health and wellbeing initiatives

Awin Academy training suite for professional growth

Peer-to-peer recognition programme

Responsabilità

Secure the SDLC by integrating SAST, DAST and SCA into CI/CD pipelines and IDEs; automate checks to enable early fixes

Conduct threat modeling and secure design reviews with product and engineering teams

Provide guidance on secure coding, perform targeted code reviews, and assist with remediation

Manage vulnerability lifecycle across internal and external apps; track and report findings





Support bug bounty validation and present vulnerability reports to senior leaders

Provide security guidance for AI/ML/LLM features; manage risks like prompt injection and data leakage

Collaborate on incident investigations and post-incident mitigation strategies

Drive security culture; deliver trainings, workshops, and contribute to playbooks and standards

Research and innovate to reduce risks across software supply chain and showcase AI tool usage for security improvements

Requisiti fondamentali

- 5+ years in application security or related roles
- Experience collaborating with engineers and product managers to secure web apps
- Agile experience
- Excellent English communication and interpersonal skills
- Mentorship and training capabilities
- Ability to work across two departments with multiple touchpoints
- Coding proficiency in JS, PHP, Python
- Experience with Cloud Native environments (AWS), Containers and Terraform
- Hands-on experience with DAST, SAST, SCA, and reporting/dashboarding tools
- Interpersonal communication
- Mentorship and training
- Cross-functional collaboration
- SAST, DAST, SCA tooling
- CI/CD integration
- Threat modelling

📌 Application Security Engineer - Remote (Milano)
🏢 Awin
📍 Milano