Application Security Engineer (F/M/D)
Pubblicato il 01-10-2026 - Awin in Milano
OverviewAs AppSec Lead, you establish and drive our Application Security program within Product & Technology.
You'll evangelize AppSec, work with engineers and product managers to design secure products, and own the training and Security Champions initiatives to scale DevSecOps.
You will integrate security into the SDLC, guide secure design and coding practices, and manage vulnerability lifecycle across internal and external apps.
You'll stay ahead of AI/LLM security trends and contribute to incident reviews and security playbooks.
Retribuzione / BenefitsFlexi-Week with four-day structure
Hybrid/remote working setup
Monthly work expense allowance and home office furniture package
Health and wellbeing initiatives
Awin Academy training suite for professional growth
Peer-to-peer recognition programme
ResponsabilitàSecure the SDLC by integrating SAST, DAST and SCA into CI/CD pipelines and IDEs; automate checks to enable early fixes
Conduct threat modeling and secure design reviews with product and engineering teams
Provide guidance on secure coding, perform targeted code reviews, and assist with remediation
Manage vulnerability lifecycle across internal and external apps; track and report findings
Support bug bounty validation and present vulnerability reports to senior leaders
Provide security guidance for AI/ML/LLM features; manage risks like prompt injection and data leakage
Collaborate on incident investigations and post-incident mitigation strategies
Drive security culture; deliver trainings, workshops, and contribute to playbooks and standards
Research and innovate to reduce risks across software supply chain and showcase AI tool usage for security improvements
Requisiti fondamentali5+ years in application security or related roles
Experience collaborating with engineers and product managers to secure web apps
Agile experience
Excellent English communication and interpersonal skills
Mentorship and training capabilities
Ability to work across two departments with multiple touchpoints
Coding proficiency in JS, PHP, Python
Experience with Cloud Native environments (AWS), Containers and Terraform
Hands-on experience with DAST, SAST, SCA, and reporting/dashboarding tools
Interpersonal communication
Mentorship and training
Cross-functional collaboration
SAST, DAST, SCA tooling
CI/CD integration
Threat modelling