Application Security Engineer (f/m/d)
Pubblicato il 17-09-2026 - Awin in Milano
Overview
As AppSec Lead, you establish and drive our Application Security program within Product & Technology. You’ll evangelize AppSec, work with engineers and product managers to design secure products, and own the training and Security Champions initiatives to scale DevSecOps. You will integrate security into the SDLC, guide secure design and coding practices, and manage vulnerability lifecycle across internal and external apps.
You’ll stay ahead of AI/LLM security trends and contribute to incident reviews and security playbooks.
Retribuzione / Benefits
- Flexi-Week with four-day structure
- Hybrid/remote working setup
- Monthly work expense allowance and home office furniture package
- Health and wellbeing initiatives
- Awin Academy training suite for professional growth
- Peer-to-peer recognition programme
Responsabilità
- Secure the SDLC by integrating SAST, DAST and SCA into CI/CD pipelines and IDEs; automate checks to enable early fixes
- Conduct threat modeling and secure design reviews with product and engineering teams
- Provide guidance on secure coding, perform targeted code reviews, and assist with remediation
- Manage vulnerability lifecycle across internal and external apps; track and report findings
- Support bug bounty validation and present vulnerability reports to senior leaders
- Provide security guidance for AI/ML/LLM features; manage risks like prompt injection and data leakage
- Collaborate on incident investigations and post-incident mitigation strategies
- Drive security culture; deliver trainings, workshops, and contribute to playbooks and standards
- Research and innovate to reduce risks across software supply chain and showcase AI tool usage for security improvements
Requisiti fondamentali
- 5+ years in application security or related roles
- Experience collaborating with engineers and product managers to secure web apps
- Agile experience
- Excellent English communication and interpersonal skills
- Mentorship and training capabilities
- Ability to work across two departments with multiple touchpoints
- Coding proficiency in JS, PHP, Python
- Experience with Cloud Native environments (AWS), Containers and Terraform
- Hands-on experience with DAST, SAST, SCA, and reporting/dashboarding tools
- Interpersonal communication
- Mentorship and training
- Cross-functional collaboration
- SAST, DAST, SCA tooling
- CI/CD integration
- Threat modelling