Experteer Overview In this role you will lead and hands-on architect the application security program across Armis' SaaS and on-prem platforms, integrating AppSec findings into VIPR and the broader risk framework. You’ll work with engineering, product security, and vulnerability management to identify, prioritize, and remediate risks throughout the SDLC. You’ll drive secure design reviews, threat modeling, and automated security testing while measuring and communicating risk and remediation effectiveness. This is a high-impact role shaping how security enables rapid, reliable software delivery at scale.Compensaciones / Incentivos - Lead the Application Security program across all products and embed security in the SDLC - Perform secure design and architecture reviews with engineering teams - Lead threat modeling sessions (STRIDE, DREAD, PASTA) - Own application-layer vulnerability management within VIPR from detection to validation - Integrate AppSec findings (SAST, DAST, SCA, API testing) into centralized workflows and risk models - Correlate vulnerabilities with asset context, exploit intel, and business criticality for risk-based remediation - Track VMDR metrics (MTTD, MTTR, exposure windows, remediation effectiveness) - Build and maintain automated AppSec pipelines for SAST, DAST, SCA, API security - Collaborate with DevOps to integrate security scanning into CI/CD (GitHub Actions, Jenkins, Buildkite) - Partner with Cloud and Infrastructure Security to secure APIs, microservices, and containers - Develop secure coding standards for React, Node.Js, Python, Java,



Go; mentor engineers - Deliver secure coding training and threat modeling workshops - Translate vulnerabilities into clear risk and remediation guidance for engineering leadership - Support compliance and audit readiness (SOC 2, ISO 27001, FedRAMP, HIPAA)Responsabilidades - 7-10+ years in Application Security, Product Security, or Secure Software Engineering - Proven expertise in SAST, DAST, SCA, and dependency management tools (Veracode, Checkmarx, Fortify, Snyk, SonarQube, OWASP Dependency-Check) - Hands-on experience in SaaS/cloud-native or cybersecurity product environments - Experience integrating AppSec into VIPR or exposure management programs - Familiarity with cloud and container security platforms (Prisma Cloud, Wiz, Orca) - Experience with IaC security (Terraform, CloudFormation) - Exposure to API Gateway security, OAuth2, token-based auth, and zero-trust architectures - Certifications such as OSWE, CSSLP, GWAPT, GWEB, CEH (preferred) - Hands-on coding in at least two languages (Python, JavaScript/TypeScript, Java, Go) - Strong vulnerability lifecycle management skills (triage, prioritization, remediation tracking, validation) - Deep understanding of OWASP Top 10, CWE, CVE, exploitability concepts - Strong knowledge of CI/CD pipelines, Git workflows, secure build automation - Experience with threat modeling, secure architecture reviews, microservices/API security - Ability to clearly communicate technical risk to engineering and business stakeholdersRequisitos principales -

📌 Ps, Solution Architect ( Armis/Veza) (Madrid)
🏢 ServiceNow
📍 Madrid