OverviewIn this hands-on role, you own application security across Product Engineering and drive secure-by-default solutions.
You will implement and tune security tooling in pipelines, work closely with cross-team engineers to remediate findings, and shape the security roadmap aligned with OWASP frameworks.
You lead incident response for application-layer issues, mentor Security Champions, and report posture to CTO/VP of Engineering on a fixed cadence.
Your impact is enabling teams to fix security without depending on you for the next project.
Compensaciones / Beneficios28-days holiday
monthly Treatwell vouchers
mental health support via Open-Up
equal opportunities
adjustment-friendly recruitment process
market-specific benefits to be discussed
ResponsabilidadesOwn application security across Product Engineering and remediate vulnerabilities in codebases
Own and land security tooling (SAST, secrets detection, DefectDojo) and integrate findings into DefectDojo
Run threat modelling with teams and improve AI-based threat modeller
Triaging findings from scanners, pentests, and external reports with ownership and SLAs
Lead security investigations for application-layer incidents and coordinate postmortems
Manage security vendor relationships and oversee annual pen-test cycle
Act as security reviewer in third-party risk processes for new vendors
Grow Security Champions program with quarterly security improvements
Maintain a short Now/Next/Later security roadmap
Ensure secure defaults in authentication, sessions, input validation, secrets handling, and CI checks




Champion cross-area remediation with teams and avoid gatekeeping when possible
Present security posture to CTO and VP of Engineering on cadence
Align security work with DevSecOps Maturity Model and report progress
Requisitos principalesHands-on experience fixing vulnerabilities in production code (Java, Ruby, TypeScript)
Proficiency with OWASP ASVS and Top 10 from code perspective
Experience integrating SAST, dependency scanning, or secrets detection into CI pipelines (GitLab CI or GitHub Actions)
Familiarity with vulnerability management platforms and closing findings without manual chasing
Understanding of authentication, sessions, authorization, and payments flow security (e.g., IDOR, JWT, tokens)
Know-how of AWS and Kubernetes from an application security lens
Ability to explain risk to engineers and leaders in plain language
Experience using AI tooling for threat modelling, code review, and reading unfamiliar codebases
Track record of moving security findings to closure in DefectDojo or equivalent
Experience with security governance and vendor risk processes
Ability to pair with engineers to fix issues and bake security into codebase
Ability to transfer skills to teams so they do not need ongoing hand-holding
Collaborative and hands-on
Clear communicator with non-technical stakeholders
Threat-driven and proactive problem solver
Java/Spring Boot, Ruby on Rails, React/TypeScript, Swift/Kotlin (mobile)
SAST, secrets detection, dependency scanning, DefectDojo
CI/CD tooling (GitLab CI, GitHub Actions, ArgoCD)

📌 Senior Application Security Engineer - España (Valladolid)
🏢 Treatwell
📍 Valladolid