Senior Security Engineer - Application Security

About the role

Yapı Kredi Technology, a technology company serving the finance sector with more than 2,000 employees, is hiring a Senior Security Engineer focused on application security. The role covers penetration testing, vulnerability analysis, secure software development practices and DevSecOps automation.

Key responsibilities

• Perform application security assessments, including web, mobile and API penetration tests
• Carry out threat modeling and design reviews within the secure software development lifecycle and give feedback to development teams
• Analyse detected vulnerabilities in depth
• Review findings, tune and set policies within application security solutions (SAST, DAST, IAST, SCA)
• Run network penetration tests and carry out Red Team/Purple Team activities as needed
• Automate security testing at scale (DevSecOps) and help set up, configure and maintain security tools on CI/CD infrastructure
• Take an active part in developing internal processes, procedures and standards

Required profile

• Minimum 4 years of experience in security and software engineering roles; 10 years of experience is acceptable
• Bachelor's degree in Computer, Electronics, Communication Engineering, Mathematics or a related field
• Experience in application penetration testing (web, mobile, API, thick client) and source code security analysis
• Keeps up with the latest cyber security threats and vulnerabilities
• Openness to continuously acquiring new skills

Required skills

• Preferred: familiarity with web application frameworks, API technologies and microservices
• Preferred: experience with C, C#, Java and Python
• Preferred: Master's degree in a relevant cyber security field and an offensive or application security certificate

What we offer

• Hybrid working model and the option to work in Koç Group community companies' offices
• Structured technology career path and career development opportunities
• Access to BizClub and KoçAilem employee privileges
• Company-contributed individual retirement insurance and a birthday off day

Candidates go through technical interviews, director assessments, competency evaluations and personality tests.