Senior Application Security Engineer

🔥 0 minutes ago

🇪🇸 Spain – Remote

⏰ Full Time

🟠 Senior

💻 Application Engineer

👻 Ghost score 11%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Treatwell

WebsiteLinkedInAll Job Openings

501 - 1000 employees

Founded 2013

🍽️ Food & Beverage

🏥 Healthcare

🏨 Hospitality

Food & Beverage • Healthcare • Hospitality

Treatwell is a platform that allows users to book beauty services online. Operating in various countries across Europe, including Belgium, France, Germany, Greece, Ireland, Italy, and the United Kingdom, Treatwell connects users with beauty and wellness treatments at spas and salons. It aims to simplify the process of finding, booking, and managing beauty and wellness appointments, offering a comprehensive service for personal care and beauty needs.

📋 Description

• Own application security across Product Engineering and remediate vulnerabilities in codebases • Own security tooling including secrets detection, dependency scanning, SAST, DefectDojo, and threat modelling • Complete SAST vendor proof of concept across pilot teams and tune rules for developer trust • Integrate findings into DefectDojo and automate team ownership, repository coverage, and pipeline-blocking rules • Build secure defaults into shared libraries and pipeline templates for authentication, session handling, input validation, secrets, dependency, and container checks • Run threat modelling and produce owned, dated backlog items • Triage scanner, penetration-test, and external findings and track remediation to closure against severity SLAs • Lead application-layer incident response, assess potential personal-data exposure with Legal, write postmortem actions, and support fraud, phishing, and customer-flagged cases • Own penetration-testing, responsible-disclosure, security inbox, and SAST vendor relationships • Review third-party risks and answer partner security questionnaires • Measure and present security posture to the CTO and VP of Engineering • Grow the Security Champions programme and coordinate quarterly security improvements • Maintain and communicate a Now/Next/Later security roadmap

🎯 Requirements

• Experience as an application security engineer, or as a backend engineer who owned security for a product • Ability to read and write production code in at least one of Java, Ruby, or TypeScript • Knowledge of OWASP ASVS and OWASP Top 10 • Experience running threat models that produce backlog items • Experience integrating SAST, dependency scanning, or secrets detection into GitLab CI or GitHub Actions pipelines • Experience with vulnerability management platforms • Understanding of authentication, sessions, authorisation, payments flows, IDOR, token and magic-link misuse, JWT validation mistakes, race conditions, injection, and device-ID collisions • Knowledge of AWS and Kubernetes sufficient to identify application/platform security boundaries • Ability to explain security risk to technical and non-technical stakeholders • Ability to use AI tooling for threat modelling, code review, and unfamiliar codebases • Nice to have: experience with marketplace, payments, or SaaS businesses handling card and personal data under PCI DSS and GDPR • Nice to have: bug bounty, CTF, penetration-testing background, or OSCP, OSWE, or BSCP certification • Nice to have: Security Champions programme experience • Nice to have: OWASP DevSecOps Maturity Model or another maturity framework • Nice to have: WAF, bot protection, secrets management, infrastructure-as-code scanning, AWS, Spring Security, Rails security internals, or custom SAST rules

🏖️ Benefits

• 28-days holiday, plus bank holidays • Monthly €40 Treatwell vouchers • Mental health support through partnership with Open-Up • Market-specific benefits discussed in the interview process