Infiterra S.A - Senior Application Security Engineer (Romania)

• Embed security into the SDLC • Integrate security activities across all SDLC phases: requirements, design, implementation, testing, deployment, and maintenance. • Partner closely with engineering teams to ensure secure development practices are applied consistently. • Review security controls for new features, services, and architectural changes. • Threat modeling & secure design • Run threat modeling sessions (e.g. STRIDE) for new and existing systems. • Identify threats, attack paths, misconfigurations, and insecure design patterns. • Collaborate with engineers to ensure systems follow secure-by-design principles. • Secure code & architecture reviews • Perform security-focused code reviews to identify vulnerabilities and risky implementations. • Provide clear, actionable guidance on secure coding patterns and best practices. • Assess application and system architectures from a security perspective. • Security testing & tooling • Perform manual and automated web application security testing (e.g. injection flaws, auth issues, access control gaps, insecure configs, logic flaws). • Operate, tune, and improve AppSec tooling (SAST, DAST, SCA, secrets scanning, dependency scanning). • Integrate and automate security checks within CI/CD pipelines. • Identify gaps in tooling and recommend or introduce improvements. • Incident response support • Support engineering teams during application security incidents or vulnerability disclosures. • Contribute to triage, impact assessment, and root cause analysis. • Ensure lessons learned are fed back into design, tooling, and processes. • Security awareness & enablement • Enable engineers through training, documentation, and hands-on guidance. • Create and maintain secure coding guidelines, checklists, and internal resources. • Act as a trusted security partner, not a blocker.