Senior Application Security Engineer

About the role

We are looking for a Senior Application Security Engineer to lead threat modeling, secure design reviews and the implementation of security solutions across Bykea’s applications and infrastructure. You will work closely with engineering teams to embed security early in the development lifecycle and ensure a security‑by‑default architecture.

Key responsibilities

• Lead threat modeling and secure design reviews for applications and infrastructure.
• Design and implement scalable security solutions to detect and remediate vulnerabilities.
• Integrate SAST, DAST and other security tools into CI/CD pipelines to drive “shift‑left” security.
• Conduct advanced dynamic and static analysis across microservices and mobile applications.
• Identify, prioritize and remediate security risks in products, features and infrastructure.
• Define and enforce application security best practices throughout the SDLC.
• Assess and mitigate risks from third‑party libraries and dependencies.
• Lead vulnerability triage and remediation in collaboration with engineering teams.
• Act as a security champion, mentoring teams and promoting a security‑first culture.

Required profile

• 5+ years of hands‑on application security experience with measurable security improvements.
• Strong scripting or development skills, preferably Python and JavaScript.
• Proven experience integrating and managing SAST/DAST tools in CI/CD environments.
• Solid background in cloud and infrastructure security (AWS, Kubernetes, Terraform/CloudFormation).
• Deep understanding of web security principles, TLS/SSL, authentication mechanisms and network protocols.
• Experience securing mobile applications, web applications and microservices architectures.
• Relevant certifications such as OSCP or AWS Security Specialty are a plus.

Required skills

• Python
• JavaScript
• SAST and DAST tools
• CI/CD pipeline integration
• AWS
• Kubernetes
• Terraform / CloudFormation
• TLS/SSL
• Authentication mechanisms
• HTTP/HTTPS, TCP/IP
• Mobile application security
• Microservices security
• GCP (optional)