Application Security Engineer
Pubblicato il 17-09-2026 - Awin Global in Milano
Purpose of Position
Your role is to establish and lead an AppSec program within the Product and Technology department, acting as an evangelist for AppSec, trusted by engineers and managers alike. As a member of the core security team, you will engage in assessing application design proposals, to identify improvements to enable our engineers to create secure products. You will own the existing training program, redesign it to better equip engineers with the knowledge needed to develop secure applications, and create a Security Champions program to scale and embed a DevSecOps mindset across P&T.;
What You'll Be Responsible For
- Secure the SDLC: Integrate security tooling (e.g. SAST, DAST, dependency scanning) into CI/CD pipelines and IDEs. Automate and optimise checks so teams can identify and fix issues early and efficiently.
- Threat modelling & secure design: Collaborate with product and engineering teams during the design phase to conduct threat modelling sessions and pre-implementation security reviews.
- Code & architecture reviews: Guide developers on secure coding practices,
perform targeted code reviews, and help resolve vulnerabilities with actionable remediation support.
- Vulnerability lifecycle management:
- Identify, triage, track and report on vulnerabilities across internal and external apps and systems.
- Collaborate with engineers to close gaps efficiently.
- Support the bug bounty process with finding validation.
- Present vulnerability management reports to our heads of department.
- AI/ML & LLM security:
- Provide guidance on secure development of AI/LLM-powered features.
- Help teams manage risks such as prompt injection, model misuse, and data leakage.
- Lead threat modelling exercises for AI components and advise on secure integration patterns.
- Incident response collaboration: Support investigation and root cause analysis of application-layer incidents. Contribute to post-incident reviews and longer-term mitigation strategies.
- Security cult