DevSecOps & Application Security Lead
We are looking for a DevSecOps and Application Security Lead to join our team and build our application security from scratch. In this role, you will lead the security direction within our department, focusing on integrating security into the software development process. By balancing automation with practical DevSecOps practices, you will help our engineering teams find and fix vulnerabilities early, ensuring our products are safe and strong without slowing down development.
Responsibilities
Build the DevSecOps/AppSec function from scratch, and create the roadmap, KPIs, and metrics for leadership
Create secure development processes, including release security gates and vulnerability management
Choose, configure, and integrate security scanners (SAST, SCA, secrets) with a focus on automation and AI-assisted workflows
Integrate security checks into pipelines and development processes together with Engineering, DevOps, and Product teams
Run threat modeling and security reviews for high-risk systems and major architecture changes
Create clear security standards, checklists, and practical guidelines for developers (covering code, APIs, and secrets)
Launch and grow a Security Champions program to involve engineers in security processes
Help investigate incidents related to application vulnerabilities, leaked secrets, and supply-chain attacks
Requirements
5+ years of experience in DevOps, SRE, Platform Engineering, or related infrastructure/security roles
3+ years focused on DevSecOps and Application Security
1+ years in a lead/ownership role
Deep understanding of modern software development, Git workflows, and hands-on experience integrating security checks into CI/CD pipelines without creating bottlenecks
Practical experience with SAST, SCA, secrets scanning, and vulnerability management (triage, risk rating, remediation, and validation)
Ability to select and scale security tools based on accuracy, false-positive rates, and developer experience
Strong knowledge of web/API/mobile risks (OWASP Top 10, auth, supply-chain risks) and ability to run threat modeling and secure design reviews
Good scripting skills (Python, Bash, or similar) and understanding of cloud-native/containerized environments
Ability to write clear security requirements and guidelines for developers
English - Intermediate+ or higher
Nice to Have
Experience building AppSec/DevSecOps functions from scratch or early maturity stages
Hands-on experience with tools like Snyk, Aikido, Semgrep, Trivy, Gitleaks, GitHub/GitLab Security, or SonarQube
Experience with cloud/IaC security, Kubernetes, and mobile app security
Knowledge of compliance standards (SOC 2, ISO 27001, PCI DSS, DORA) and experience with Bug Bounty or pentest coordination
Experience with Security Champions programs and AI-assisted security tools
We offer
20 paid vacation days per year
10 paid sick leave days per year
Public holidays as per the company’s approved Public holiday list
Medical budget
Opportunity to work remotely
Professional education budget
Language learning budget
Wellness budget (gym membership, sports gear and related expenses)
Responsibilities
Build the DevSecOps/AppSec function from scratch, and create the roadmap, KPIs, and metrics for leadership
Create secure development processes, including release security gates and vulnerability management
Choose, configure, and integrate security scanners (SAST, SCA, secrets) with a focus on automation and AI-assisted workflows
Integrate security checks into pipelines and development processes together with Engineering, DevOps, and Product teams
Run threat modeling and security reviews for high-risk systems and major architecture changes
Create clear security standards, checklists, and practical guidelines for developers (covering code, APIs, and secrets)
Launch and grow a Security Champions program to involve engineers in security processes
Help investigate incidents related to application vulnerabilities, leaked secrets, and supply-chain attacks
Requirements
5+ years of experience in DevOps, SRE, Platform Engineering, or related infrastructure/security roles
3+ years focused on DevSecOps and Application Security
1+ years in a lead/ownership role
Deep understanding of modern software development, Git workflows, and hands-on experience integrating security checks into CI/CD pipelines without creating bottlenecks
Practical experience with SAST, SCA, secrets scanning, and vulnerability management (triage, risk rating, remediation, and validation)
Ability to select and scale security tools based on accuracy, false-positive rates, and developer experience
Strong knowledge of web/API/mobile risks (OWASP Top 10, auth, supply-chain risks) and ability to run threat modeling and secure design reviews
Good scripting skills (Python, Bash, or similar) and understanding of cloud-native/containerized environments
Ability to write clear security requirements and guidelines for developers
English - Intermediate+ or higher
Nice to Have
Experience building AppSec/DevSecOps functions from scratch or early maturity stages
Hands-on experience with tools like Snyk, Aikido, Semgrep, Trivy, Gitleaks, GitHub/GitLab Security, or SonarQube
Experience with cloud/IaC security, Kubernetes, and mobile app security
Knowledge of compliance standards (SOC 2, ISO 27001, PCI DSS, DORA) and experience with Bug Bounty or pentest coordination
Experience with Security Champions programs and AI-assisted security tools
We offer
20 paid vacation days per year
10 paid sick leave days per year
Public holidays as per the company’s approved Public holiday list
Medical budget
Opportunity to work remotely
Professional education budget
Language learning budget
Wellness budget (gym membership, sports gear and related expenses)