Application Security Engineer

Stack

Responsibilities

• ▹Perform application security assessments including threat modelling, secure code reviews, and penetration testing across web, mobile, and API surfaces
• ▹Integrate security controls into CI/CD pipelines using SAST, DAST, SCA, and secrets detection tooling
• ▹Identify, triage, and track vulnerabilities through to remediation
• ▹Define and maintain application security standards, secure coding guidelines, and developer-facing documentation
• ▹Champion security-by-design principles, providing hands-on guidance during design and architecture phases
• ▹Lead and support bug bounty and responsible disclosure programmes
• ▹Conduct security training and awareness sessions for software engineers
• ▹Evaluate third-party libraries, open-source components, and vendor integrations for security risk
• ▹Collaborate with the broader Security team on application-layer incident response

Requirements

• ▹8+ years of experience in information security, including at least 3 years specializing in application security or software security engineering
• ▹Solid understanding of common vulnerability classes including OWASP Top 10, business logic flaws, and API security risks
• ▹Hands-on experience with security testing tools such as Burp Suite, OWASP ZAP, Semgrep, Checkmarx, or Snyk
• ▹Proficiency in at least one programming or scripting language (Python, JavaScript, Java, Go, or similar) to support code review and automation

About the company

Pepperstone is a global fintech founded in 2010, enabling clients to trade the world's markets. Its 700+ person team operates across 12 regions and 9 time zones.