Application Security Engineer

About this role

You will own application security at OptiKratos — building the AppSec toolchain and unblocking enterprise deals that require completed security questionnaires. You will embed with Engineering on the CI/CD pipeline, implementing SAST, DAST, and dependency scanning gates.

What you'll do

• Own the application security roadmap — SAST/DAST integration, dependency scanning, secret detection.
• Embed in the GitLab CI pipeline: add and maintain security stage gates (Semgrep, Trivy, Bandit, OWASP ZAP).
• Conduct threat modelling and security design reviews for new modules and API endpoints.
• Respond to and triage security questionnaires from enterprise prospects.
• Drive SOC 2 Type II application-level controls — logging, access review, evidence collection.
• Run periodic penetration tests (internal and via third-party) and own remediation tracking.

What we're looking for

• 3+ years in application security or security engineering.
• Hands-on experience with SAST tools (Semgrep, SonarQube, Bandit) and DAST (OWASP ZAP, Burp Suite).
• Strong understanding of OWASP Top 10, API security, and common web vulnerabilities.
• Experience integrating security gates into CI/CD pipelines.
• Familiarity with SOC 2 or ISO 27001 application controls.

Nice to have

Not required — but they will make us notice your application.

• OSCP, CEH, or similar offensive security certification.
• Experience with multi-tenant SaaS security architecture.
• Python scripting for security automation.