Security Engineer

About the role

Air Apps is looking for a Security Engineer to protect its applications, infrastructure, and data. You will partner with development, DevOps, and IT teams to embed security throughout the product lifecycle and keep the platform resilient against cyber threats.

Key responsibilities

• Develop and implement threat modeling to identify security risks across applications and infrastructure.
• Conduct vulnerability scanning, penetration testing, and security assessments.
• Define and enforce secure coding practices in collaboration with development teams.
• Integrate security into CI/CD pipelines and automate security testing with DevOps.
• Monitor and respond to security incidents, perform root‑cause analysis, and implement preventative measures.
• Ensure compliance with standards such as ISO 27001, GDPR, and SOC 2.
• Design and implement IAM policies, encryption standards, and authentication mechanisms.
• Collaborate with product teams on security reviews of features, APIs, and third‑party integrations.
• Develop incident response plans, documentation, and best practices.
• Stay ahead of emerging threats, vulnerabilities, and security technologies.

Required profile

• 4+ years of experience in cybersecurity, application security, or security engineering.
• Strong knowledge of secure coding principles, OWASP Top 10, and threat‑modeling techniques.
• Experience with vulnerability scanning tools and penetration‑testing methodologies.
• Hands‑on experience with SIEM, IDS, and security monitoring tools.
• Proficiency in scripting and automation (Python, Bash, PowerShell).
• Familiarity with cloud security in AWS, Azure, or GCP, including IAM and workload protection.
• Knowledge of encryption protocols, network security, and API security best practices.
• Experience working with DevSecOps and integrating security into CI/CD pipelines.

Required skills

• Threat modeling
• Vulnerability scanning
• Penetration testing
• Secure coding
• OWASP Top 10
• Nessus
• Qualys
• Burp Suite
• SIEM
• IDS
• Python
• Bash
• PowerShell
• AWS
• Azure
• GCP
• IAM
• Encryption protocols
• API security
• CI/CD pipelines
• DevSecOps