Application Security Engineer (F/M)

About the project

We are looking for an Application Security Engineer (F/M) to join our engineering team and help us build security into the software development lifecycle.

This role is an opportunity to move beyond traditional vulnerability management and drive a proactive approach to application security. You will work closely with software engineers, architects, DevOps and security teams to automate security controls, integrate security into CI/CD pipelines, improve secure development practices and help teams build secure-by-design applications.

This is how we organize our work

This is how we work

• in house
• you have influence on the technological solutions applied
• you have influence on the product
• you focus on product development
• agile
• scrum

Your responsibilities

• Own and continuously improve the application security posture of internally developed solutions, ensuring security is embedded throughout the software development lifecycle (SDLC).
• Monitor, assess, prioritise, and manage application security vulnerabilities identified through penetration testing, SAST, DAST, dependency scanning, bug bounty programmes, and other security assessment activities, ensuring remediation within agreed SLAs.
• Triage security findings to determine business risk, remediation requirements, and false positives, providing clear technical justification for all decisions.
• Design, recommend and implement long-term, scalable security controls and automation to reduce recurring vulnerabilities, minimise manual intervention, and improve remediation efficiency across development teams.
• Drive a shift-left security approach by integrating automated security testing, policy enforcement, and secure development practices into CI/CD pipelines and engineering workflows.
• Identify recurring vulnerability patterns and implement preventative controls, secure frameworks, coding standards, and developer guardrails that eliminate classes of vulnerabilities at source.
• Serve as the primary liaison with external penetration testing providers, ensuring security assessments are completed in a timely manner and findings are actionable, risk-based, and aligned with business priorities.
• Partner with Group Security teams to maintain a single source of truth for vulnerabilities, consult, agree risk ratings, and resolve disputes relating to remediation requirements or false-positive findings.
• Provide expert guidance on securing modern web applications, APIs, authentication mechanisms, and cloud-native architectures, with particular focus on .NET and Angular solutions.
• Act as the Application Security subject matter expert for the Solution Delivery organisation, promoting secure design principles and security-by-default practices across all stages of solution delivery.
• Maintain and enhance secure development standards, application security policies, and security engineering processes in line with OWASP, NIST, and industry best practices.
• Proactively monitor emerging threats, OWASP Top 10 trends, attack techniques, and security tooling innovations, ensuring the organisation remains ahead of evolving application security risks.
• Deliver security awareness and secure coding guidance to developers, technical leads, architects, and delivery teams to improve organisational security maturity.
• Update on application security posture, vulnerability trends, remediation performance, and risk reduction initiatives to governance forums and steering groups, providing data-driven insights and recommendations.

Our requirements

• Strong practical knowledge of the OWASP Top 10 and common web application attack vectors.
• Deep understanding of securing modern web applications, REST APIs, authentication and authorisation mechanisms (OAuth2, OIDC, JWT).
• Experience implementing and managing SAST, DAST, SCA, API security and penetration testing programmes.
• Experience automating security controls within CI/CD pipelines and software delivery processes.
• Strong knowledge of secure software engineering practices and secure-by-design principles.
• Experience with .NET, Angular, JavaScript/TypeScript, and modern web application architectures.
• Ability to identify strategic security improvements rather than focusing solely on vulnerability remediation.
• Strong stakeholder management skills, with the ability to influence development teams, architects, and security functions.
• Highly motivated, enthusiastic, and capable of working both independently and collaboratively in a team-oriented environment.
• Exceptional analytical and problem-solving skills, with attention to detail and a business-focused approach.
• Strong interpersonal skills, with the ability to influence technical decisions and communicate effectively in a fast-paced environment.
• Demonstrates creativity and resourcefulness in presenting solutions to complex security challenges.

What we offer

• The opportunity to influence technological solutions and product direction in an international financial organization
• Ambitious projects with a high degree of autonomy and responsibility
• A stable, long-term assignment with flexible working hours and a hybrid work model

This is how we work on a project

• Clean Code
• code quality measures
• code review
• static code analysis
• BDD
• TDD
• architect / technical leader support
• Continuous Deployment
• Continuous Integration
• DevOps
• documentation
• issue tracking tools
• integration tests
• pen tests
• regression tests
• test automation
• manual tests

Benefits

• remote work opportunities
• flexible working time
• fruits
• integration events
• no dress code
• video games at work
• coffee / tea
• drinks
• parking space for employees
• leisure zone

AXA IT Solutions

We are an internal software house operating within the international insurance group AXA. We provide IT solutions for the needs of AXA companies in Europe. We work in English on a daily basis, in close-knit teams, carrying out international development projects.