Application Security Engineer

About the role

Zoolatech is collaborating with a leading European online fashion and beauty retailer to find an Application Security Engineer. The role focuses on threat modeling, application security architecture and technical design reviews, working closely with software engineers and architects to identify security risks and give practical recommendations. It also covers AI-powered solutions and modern cloud-native applications.

Key responsibilities

• Conduct structured threat modeling for web applications using methods such as STRIDE
• Review and validate AI-assisted threat modeling outputs and recommend improvements
• Perform application security architecture and technical design reviews
• Recommend secure design patterns and mitigation strategies
• Advise on authentication and authorization, API security, token management and secrets handling
• Integrate security best practices into application design and development
• Assess security risks in AI/LLM-based applications and architectures
• Apply standards such as OWASP Top 10 for Web Applications and OWASP Top 10 for LLM Applications

Required profile

• 5-10 years of professional experience in application security
• Proven experience in application security architecture and technical design reviews
• Ability to communicate security risks clearly and work independently with cross-functional teams

Required skills

• Manual threat modeling and STRIDE
• OWASP Top 10 for Web Applications and REST API security
• OAuth 2.0/2.1, OIDC, JWT/JWS/JWE, mTLS, SAML
• RBAC, ABAC, and policy-as-code tools such as OPA, Rego or Cedar
• Cloud-native architectures and common backend technologies
• Nice to have: AI/LLM application security, IDE or CI/CD integrations, and automated threat modeling tools

The engagement is a direct independent contractor arrangement with Zoolatech; candidates must be able to sign a service agreement and invoice directly, and only those whose profiles closely match the requirements will be contacted.