Application Security Engineer (m/w)

Job Informationen ######

Location: Zurich, hybrid
Workload: Full-time

This is a hands-on technical role for someone who can operate deeply across modern application security disciplines and cloud-native environments. You will contribute to application security across our platform, covering web, mobile, APIs, backend services, and cloud infrastructure, by embedding security into engineering processes, CI/CD pipelines, and runtime environments.

Your main responsibilities include:

• Integrate and improve security controls within CI/CD pipelines including SAST, DAST, SCA, and IaC scanning to strengthen DevSecOps practices.
• Configure, operate, and optimise application security tooling, ensuring findings are actionable and integrated into engineering workflows.
• Partner with engineering, platform, and product teams to design and implement secure-by-design architectures, perform threat modelling and promote secure development practices.
• Evaluate open-source dependencies and contribute to software supply chain security initiatives.
• Assess and secure AI-enabled applications and services, including AI/LLM integrations, AI supply chain risks, model security controls, and secure deployment patterns.
• Review and harden Infrastructure-as-Code implementations to enable secure cloud deployment patterns and reusable guardrails.
• Assess the security design of smart contracts, blockchain integrations, and third-party Web3 services.
• Partner with SOC and engineering teams to improve detection, alerting, and response capabilities for application-layer threats.

Your profile: You are an experienced technical security expert who can demonstrate the following skills and experience:

• 5-7+ years of deep, hands-on experience in application security or DevSecOps in modern engineering environments.
• Strong experience securing cloud-native architectures (AWS and Azure preferred).
• Deep understanding of Kubernetes security, containers, and IaC security.
• Experience reviewing Infrastructure-as-Code and performing secure code reviews across backend, web, and/or mobile applications.
• Practical knowledge of application security standards, e.g. OWASP Top 10 and API Top 10 in real-world systems.
• Familiarity with runtime application security concepts including observability, detection engineering, and production security monitoring.
• Strong understanding of API security concepts including authentication, authorisation, API gateways, and modern identity patterns.
• Ability to work directly with engineers and influence design and implementation decisions.
• Experience building AI agents and applying AI to automate security workflows.
• Solid understanding of cryptography fundamentals and key management (KMS/HSM).
• Relevant education, certifications, or equivalent practical experience.

Bonus points for:

• Experience with digital asset custody, web3, smart contract or transaction signing workflows.
• Track record of owning or building an application security function.
• Background in offensive security, red teaming, or bug bounty.
• Experience with financial services regulatory requirements (FINMA, MAS, DORA).

Benötigte Skills ######

• Azure
• Security
• Senior
• CLOUD
• Mobile
• Monitoring
• AWS
• Banken / Finanzgesellschaften
• DevOps
• MAS