Application Security Engineer
Pubblicato il 16-09-2026 - Txt E-Solutions in Roma
HSPI S.p.A., part of TXT Group, is looking for a Application Security Engineer to join its team at the Rome office (Cinecittà area).Key ResponsibilitiesVulnerability Assessment & Penetration TestingProvide operational support in performing Vulnerability Assessments and Penetration Tests on web applications, IT infrastructures, cloud environments, and containerized platforms (Kubernetes/AKS).Reporting & ComplianceSupport the preparation of detailed technical reports (Technical Deep Dive Reports), classify vulnerabilities according to internationally recognized frameworks (CVSS v4.0, MITRE ATT&CK;, OWASP), and verify the effectiveness of implemented security controls through remediation retesting activities.Threat ModelingSupport the analysis of application architectures using methodologies such as STRIDE (Microsoft Threat Modeling Tool), identifying threats, assessing risks, and producing Threat Modeling and Risk Assessment documentation.Secure Code ReviewAnalyze source code using Static Application Security Testing (SAST)
tools and manual code review techniques to identify logical vulnerabilities, programming flaws, and security weaknesses.Required Technical SkillsPractical knowledge of the main categories of application vulnerabilities (OWASP, CWE).Familiarity with leading security tools such as Burp Suite, OWASP ZAP, Nessus, Nmap, and container/cloud security auditing tools including Trivy, Kube-bench, and Prowler.Basic programming and scripting skills (Python, Bash, Go, or knowledge of major web and object-oriented programming languages) to support secure code review activities.Bachelor's or Master's degree in Computer Science, Computer Engineering, or a related field.Preferred QualificationsPrevious experience, including academic or internship experience, with cloud architectures (Azure/AWS) and Docker/Kubernetes environments.Active participation in cybersecurity training platforms such as Hack The Box, PortSwigger Web Security Academy, or TryHackMe, or involveme