Application Security Engineer - Senior
我们正在寻找一个应用安全工程师加入我们的信息安全团队。信息安全团隊负责通过整体技术生命周期内嵌入安全保护 Plata 的产品，系统和数据。我们与工程团队密切合作以确定和减轻安全风险，加强应用防御，并确保安全融入软件开发的每个阶段。作为应用安全工程師，你将成为开发和安全团队之间的关键链接，设计，实施和维护强大的应用安全控制。你将帮助安装安全在整个软件开发生命周期中，从设计和开发到测试和部署，同时不断改进我们的应用程序安全实践。等待你的挑战是：· 与 Dev & Ops 团队合作。指导安全编码实践，参与代码审查，并无地嵌入 SDLC 中；•进行安全检查和威胁建模。分析应用架构，定义威胁模型，驱动主动风险识别；·集成安全工具。在 CI/CD 管道内部署和管理 SAST,DAST,IAST,RASP 和 SCA 工具以自动化早期发现和补救安全事件。· 实施转向左边战略，执行持续测试，快速修复和嵌入团队安全文化 · 教育和培训。开展研讨会提高开发人员的安全意识并促进遵守 OWASP,ASVS 以及安全设计标准什么让你非常适合：·熟练编程语言 (web/mobile) ·强大的理解网络架构 （微服务）·深厚了解 OWASM Top 10,威胁建模和安全测试框架 ·熟悉 ZAP,依赖-Track,Burp 等安全工具 ·精确且彻底关注细节的能力强大的分析技能：·安全证书 (OSCP, OSWE, GWAPT, GCPN) · 贡献或与漏洞防治或道德黑客程序的经验 · SaaS 或云本土环境的经验·熟悉 Kubernetes 或容器安全 我们的工作方式：·创新精神：致力于创造性和开创性的解决方案 ·诚实反：评估公开，透明的沟通 ·支持团队：强大，协作社区 ·庆祝成就：共同承认我们的胜利 ·高科技环境
查看英文原文
We are looking for an Application Security Engineer to join our Information Security team.
The Information Security team is responsible for protecting Plata’s products, systems, and data by embedding security throughout the technology lifecycle. We work closely with engineering teams to identify and mitigate security risks, strengthen application defenses, and ensure security is integrated into every stage of software development.
As an Application Security Engineer, you will serve as a key link between development and security teams, designing, implementing, and maintaining robust application security controls. You’ll help embed security across the entire software development lifecycle — from design and development to testing and deployment — while continuously improving our application security practices.
Challenges that await you:
- Collaborate with Dev & Ops teams. Guide secure coding practices, participate in code reviews, and embed security seamlessly into the SDLC
- Conduct security reviews & threat modeling. Analyze application architecture, define threat models, and drive proactive risk identification
- Integrate security tools. Deploy and manage SAST, DAST, IAST, RASP, and SCA tools within CI/CD pipelines to automate early detection and remediation
- Handle security incidents
- Implement “shifting left” strategies, enforce continuous testing, fast remediation, and embed security culture across teams
- Educate and train. Conduct workshops to elevate developer security awareness and promote adherence to OWASP, ASVS, and secure design standards
What makes you a great fit:
- Proficient in programming languages (web/mobile)
- Strong understanding of web architectures (microservices)
- Deep knowledge of OWASP Top 10, threat modeling, and security testing frameworks
- Familiarity with security tools such as ZAP, Dependency-Track, Burp
- Strong analytical skills with precise and thorough attention to detail
Your bonus skills:
- Security certifications (OSCP, OSWE, GWAPT, GCPN)
- Contributions to or experience with bug bounty or ethical-hacking programs
- SaaS or cloud-native environments experience
- Familiarity with Kubernetes or container security
Our ways of working:
- Innovative Spirit: A commitment to creativity and groundbreaking solutions
- Honest Feedback:valuing open, transparent communication
- Supportive Team: a strong, collaborative community
- Celebrating Achievements:recognizing our wins together
- High-Tech Environment: a team full of smart and revolutionary people who date to challenge the status quo of incumbent finances
Our benefits:
- Relocation support to Kazakhstan, Cyprus, Serbia or Georgia with full visa & permit support to the employee and family
- Flexible work from one of our offices or remote
- HealthcareCoverage
- Education Budget: Language lessons, professional training and certifications
- Wellness Budget: Mental health and fitness activity reimbursements
- Vacation policy: 20 days of annual leave and paid sick leave
Originally posted on Himalayas