Application Security Engineer

Overview

Expleo is a trusted partner for your innovation journey. As a global engineering, technology and consulting service provider, we are ideally positioned to help you achieve your ambitions and future-proof your business. With a smart blend of bold thinking and reliable execution, we’re able to fast-track innovation through each step of your value chain.We are strategically positioned to build value, with a global footprint across 30 countries.We are as global and local as you need us to be, with strong best-in-class pan-European technological centres and unique best-shoring capabilities.We leverage a network of high value-adding affiliates in consulting and industrial excellence, and leading partners across multiple sectors to provide you with the most comprehensive services and solutions in an ever-changing environment.

Responsibilities

- 5+ years of professional experience in software development and/or application architecture, with proven experience in Application Security.

- Define and promote Secure SDLC and Security-by-Design practices.

- Integrate security requirements into application architecture, design and development.

- Lead or facilitate Threat Modeling and application security reviews.

- Analyze and prioritize vulnerabilities identified through SAST, DAST, SCA, container scanning, vulnerability assessments and penetration tests.

- Coordinate penetration testing activities, including scope definition, external providers, findings validation and remediation follow-up.

- Provide hands-on support to development teams in vulnerability remediation and secure coding.

- Promote best practices around authentication, authorization, API security, data protection, cryptography and secrets management.

- Integrate security controls and automated security testing into CI/CD pipelines, supporting DevSecOps adoption.

- Develop security guidelines, standards and metrics, and promote security awareness through Secure Coding workshops and Security Champions.

Essential skills

- Strong understanding of OWASP Top 10, OWASP ASVS, Secure Coding and Threat Modeling.

- Practical knowledge of OAuth2, OpenID Connect, JWT, API Security, TLS, cryptography and secrets management.

- Strong development experience in Java/Spring Boot or C#/.NET, including REST APIs.

- Solid understanding of cloud environments, with real-world application deployment experience, preferably AWS and/or Azure.

- Good knowledge of Linux and shell scripting.

- Experience with application security tools such as SonarQube, Checkmarx, Fortify, Veracode, Snyk, Dependabot, OWASP ZAP, Burp Suite or Trivy.

- Ability to read and understand source code and application architecture and translate security findings into practical remediation.

- Strong communication and collaboration skills, with the ability to act as a technical advisor and security advocate for development teams.