Application Security Engineer

FareHarbor, a leading company in the travel and tourism industry, as a full-time Application Security Engineer. In this role, you will focus on application security and secure SDLC initiatives, while also supporting security monitoring efforts. You will work closely with the Senior Application Security Engineer on various security initiatives, perform application security reviews, and provide guidance on secure coding practices. The ideal candidate will have strong application security expertise, experience with AWS security concepts, and proficiency in Python or other high-level languages.

Responsibilities

• Collaborer avec les équipes produit, plateforme et sécurité pour garantir que la sécurité est intégrée dans notre cycle de développement logiciel (SDLC).
• Effectuer des examens de sécurité des applications, des revues de code, des modélisations de menaces et des revues de conception pour les nouvelles fonctionnalités.
• Identifier, évaluer et aider à remédier aux vulnérabilités dans les applications, les API, les services et les pipelines CI/CD de GitLab.
• Experience with AI-assisted security automation for AppSec triage, vulnerability assessment, detection tuning, and security monitoring workflows using tools such as Cursor, Tines, Elastic, or similar
• Ability to assess risk, prioritize vulnerabilities, and balance security requirements with business needs and engineering realities

Requirements

• Able to provide practical security guidance that enables teams to move quickly and securely
• Comfortable operating independently and taking ownership of security initiatives from discovery through implementation
• Good understanding of AWS security concepts, including IAM, WAF, Kubernetes, containers, and infrastructure as code
• Good understanding of incident response, security investigations, and technical incident management
• Familiarity with security and compliance frameworks such as NIST, PCI DSS, GDPR, SOC 2, SOX, or similar
• Proficiency in Python or other high-level language such as Go, Java, or similar
• Proactive attitude, always on the look-out for improving your and our way of working

Pentesting experience is a plus

• Proven experience performing application security reviews, including code reviews, design reviews, and threat modeling, as well as supporting the remediation of security findings from penetration tests, vulnerability scans, and security audits
• Able to work effectively with product, engineering, platform, infrastructure, and security teams
• Experience with API security, microservices security, and distributed application architectures
• Experience implementing security controls in GitLab CI/CD pipeline, such as SAST, DAST, SCA, secret scanning, IaC scanning, dependency scanning etc
• Strong problem-solving skills and ability to analyze complex systems and make decisions based on risk, data, and best practices
• Senior engineer with strong experience in application security, secure SDLC, strong technical knowledge of web/API security, common vulnerabilities, and practical mitigation strategies for OWASP Top 10
• Experience with security monitoring, alert tuning, SIEM use cases, logging, detection engineering, or WAF rule tuning
• Strong relationship building skills across diverse cross-functional teams
• Strong communication skills, able to explain technical security risks clearly to both technical and non-technical stakeholders

Preferred

• Security certifications such as OSCP, OSWE, OSWA, GWAPT, GWEB, CISSP, CCSP, Security+, AWS Certified Security Specialty, or similar
• Experience with bug bounty programs and coordinating vulnerability remediation with third party
• Experience with Terraform, infrastructure as code, configuration management, and policy-as-code frameworks
• Contributions to the security community through research, blog posts, conference talks, open-source tools, or responsible disclosures
• Experience building internal security tooling or developer-facing security automation