Application Security Engineer in Financial Services in Warsaw

Capital.com’s Product Security team protects web and mobile applications, infrastructure, and the external perimeter in a highly regulated environment. It designs and scales security processes that help engineering teams build securely by default.

Задачи:

• Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams.
• Influence standards, patterns, and guardrails that help teams move quickly while staying secure.
• Design, build, and automate scalable, self-service security processes for secure design review, threat modelling, testing, and remediation workflows.
• Integrate and automate security checks across SDLC and CI/CD pipelines, including SAST, DAST, SCA, secrets, and IaC scanning.
• Own and evolve security tooling, including DefectDojo and SAST, DAST, and SCA platforms.
• Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define its safe adoption.
• Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development.
• Run vulnerability scans across internal infrastructure and the external perimeter, analyse findings, define remediation, and track issues to closure.
• Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible.
• Participate in and help lead red teaming and offensive security exercises.
• Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams.

Wymagania:

• 5+ Years in application or product security, or equivalent depth, with a track record of senior- or staff-level impact.
• Experience leading security architecture reviews and threat modelling across multiple teams or products.
• Ability to automate and scale security processes by building tooling, integrations, and self-service workflows.
• Strong hands‑on security testing skills, including code review and web, mobile, and API application security assessments.
• Ability to triage and validate external vulnerability reports and bug bounty submissions.
• Strong software engineering ability in at least one language, such as Python, Go, or JavaScript.
• Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices.
• Experience with SAST, DAST, SCA, vulnerability management platforms, and CI/CD integrations.
• Strong understanding of REST APIs, microservices, cloud-based systems, and containers.
• Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so.
• Excellent communication and influencing skills; able to explain security concepts to technical and non-technical stakeholders and drive change without direct authority.
• Self‑starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture.

Будет плюсом:

• Securing LLM and agent pipelines, prompts, tool and MCP integrations, and model endpoints.
• Securing Kubernetes and AWS infrastructure.
• Building AI‑assisted security tooling or internal self‑service security platforms.
• Mentoring or technically leading a security team.
• OSAI, OSEP, OSCP, or OSWE certifications.

Условия:

• Annual bonus based on the performance review cycle.
• Generous annual leave policy.
• Medical insurance and pension fund, with additional benefit packages based on location.
• Hybrid working model with 3 days from the office and 2 days fully remotely.
• Comprehensive Workation Policy with 30 more remote days available.
• Possibility of taking two additional days of paid leave per year for volunteering.