Overview

In this hands-on role, you own application security across Product Engineering and drive secure-by-default solutions. You will implement and tune security tooling in pipelines, work closely with cross-team engineers to remediate findings, and shape the security roadmap aligned with OWASP frameworks. You lead incident response for application-layer issues, mentor Security Champions, and report posture to CTO/VP of Engineering on a fixed cadence. Your impact is enabling teams to fix security without depending on you for the next project.

Compensaciones / Incentivos

- 28-days holiday
- monthly Treatwell vouchers
- mental health support via Open-Up
- equal opportunities
- adjustment-friendly recruitment process
- market-specific benefits to be discussed

Responsabilidades

- Own application security across Product Engineering and remediate vulnerabilities in codebases
- Own and land security tooling (SAST, secrets detection, DefectDojo) and integrate findings into DefectDojo
- Run threat modelling with teams and improve AI-based threat modeller
- Triaging findings from scanners, pentests, and external reports with ownership and SLAs
- Lead security investigations for application-layer incidents and coordinate postmortems
- Manage security vendor relationships and oversee annual pen-test cycle
- Act as security reviewer in third-party risk processes for new vendors
- Grow Security Champions program with quarterly security improvements
- Maintain a short Now/Next/Later security roadmap
- Ensure secure defaults in authentication, sessions, input validation, secrets handling, and CI checks




- Champion cross-area remediation with teams and avoid gatekeeping when possible
- Present security posture to CTO and VP of Engineering on cadence
- Align security work with DevSecOps Maturity Model and report progress

Requisitos principales

- Hands-on experience fixing vulnerabilities in production code (Java, Ruby, TypeScript)
- Proficiency with OWASP ASVS and Top 10 from code perspective
- Experience integrating SAST, dependency scanning, or secrets detection into CI pipelines (GitLab CI or GitHub Actions)
- Familiarity with vulnerability management platforms and closing findings without manual chasing
- Understanding of authentication, sessions, authorization, and payments flow security (e.g., IDOR, JWT, tokens)
- Know-how of AWS and Kubernetes from an application security lens
- Ability to explain risk to engineers and leaders in plain language
- Experience using AI tooling for threat modelling, code review, and reading unfamiliar codebases
- Track record of moving security findings to closure in DefectDojo or equivalent
- Experience with security governance and vendor risk processes
- Ability to pair with engineers to fix issues and bake security into codebase
- Ability to transfer skills to teams so they do not need ongoing hand-holding

- Collaborative and hands-on
- Clear communicator with non-technical stakeholders
- Threat-driven and proactive problem solver
- Java/Spring Boot, Ruby on Rails, React/TypeScript, Swift/Kotlin (mobile)
- SAST, secrets detection, dependency scanning, DefectDojo
- CI/CD tooling (GitLab CI, GitHub Actions, ArgoCD)

📌 Senior Application Security Engineer - Treatwell (España)
🏢 Treatwell
📍 España