Application Security Engineer – Mobility Sector

About the role

Join Devoteam Cyber Trust as an Application Security Engineer focused on the Mobility sector. You will ensure that products and applications are built with security from the ground up, guiding development teams through secure design, vulnerability remediation and continuous improvement of security maturity.

Key responsibilities

• Define and promote Secure SDLC practices and integrate security requirements into the development lifecycle.
• Conduct architecture reviews, threat‑modeling sessions and support teams with authentication, authorization and data‑protection mechanisms.
• Analyze results from penetration tests, vulnerability assessments, SAST/DAST, dependency and container scanning, classify and prioritize findings and track remediation against SLAs.
• Coordinate penetration‑testing scopes with external vendors, validate findings and ensure closure of recommendations.
• Deliver secure‑coding workshops, promote OWASP Top 10, mentor security champions and produce technical guidelines.
• Integrate security controls into CI/CD pipelines, automate security checks and define application‑security KPIs.

Required profile

• Professional background in software development and application architecture who has transitioned to an Application Security role.
• Proven ability to work with development, architecture, operations and corporate security teams as a technical consultant and advocate.
• Strong analytical mindset with capacity to understand code, architecture and support vulnerability remediation.

Required skills

• Java (Spring Boot), REST APIs, Maven
• C#/.NET (Framework/Core), ASP.NET
• Angular (JavaScript/TypeScript) – optional
• Linux, shell scripting and basic system hardening
• Cloud platforms – AWS and/or Azure (production deployment experience)
• OWASP Top 10, OWASP ASVS, secure coding best practices
• Threat modeling, authentication & authorization (OAuth2, OpenID Connect, JWT)
• API security, TLS, cryptographic key‑lifecycle management, secure hashing
• Secrets management and rotation
• Security tooling: SonarQube, Checkmarx, Fortify, Veracode, Snyk, Dependabot, OWASP ZAP, Burp Suite, Trivy