https://www.linkedin.com/jobs/view/2507748143/?refId=2111cede-03f5-4126-a5b9-5c8554e74373

AppSec Engineer

Ocado Technology

Poland, Europe

About the job: The main mission of the AppSec engineers is to help us build secure systems by embedding security in our SDLC. You will achieve this by providing expertise and guidance, working closely with the development teams, central AppSec function, InfoSec team and Security Chapters. We are currently creating a centralised team of AppSec Engineers with different skills sets and levels of experience, providing services to different streams. As part of the AppSec team you will do the following: Working with development teams to provide them with help and guidance on addressing cybersecurity threats, Conducting threat modelling sessions and security code reviews, and training development teams on how to run them, Participating in security issue management processes, Educating and supporting development teams perform security activities, AppSec tooling and integrations like security issue tracking and SAST tools. As an AppSec engineer you will be involved in supporting teams of software engineers including security practices to their SDLC and maintaining the AppSec tooling integrations. The roles and responsibilities performed by the AppSec team are: Working with teams to provide them with help and guidance on addressing cybersecurity threats, Conducting threat modelling sessions and training teams on how to run them, Participating in security issue management processes, Assisting engineering teams with organising penetration testing by dedicated pentest partners, Educating and supporting teams perform their security code reviews, Oversee in-stream use of vulnerability detection and reporting tools, Auditing, providing teams with feedback and guidance about their security activities (threat modelling, code reviews, SDLC practices), Keep updated the SDLC security guidelines, Research security best practices in other organisations, Keeping abreast of new vulnerabilities and attack vectors, and associated countermeasures. What We Would Like To You To Have: Strong interest in application security, Demonstrable programming ability with an in-depth understanding of underpinning techniques, Experience in the full Software Development life-cycle from design to deployment, Ability to work in a geographically dispersed team, Strong communication skills and ability to influence engineering behaviours, Interest in continuous learning. Nice to have but do not feel hesitant to apply if you dont: Experience as an Application Security Engineer, Knowledge of backend and frontend web application vulnerabilities, Knowledge of cloud environments. 