Senior Application Security Engineer

September 30, 2026

Hybrid

Senior

Warszawa, Poland

Worth knowing

Mandatory office attendance
3 days per week
English is required

Description

Capital.com's Product Security team protects web and mobile applications, infrastructure, and external perimeter in a highly regulated environment. As Senior/Staff Application Security Engineer you will raise the bar for application security across the organisation, designing, automating, and scaling security processes so engineering teams can build securely by default. The role combines hands-on offensive and defensive security expertise with an engineering mindset needed to automate at scale, working closely with development, QA, DevOps, and platform teams.

Responsibilities

Lead security architecture reviews and threat modelling for new and existing systems using AI tools
Influence the standards, patterns, and guardrails that let teams move fast and stay secure
Design, build, and automate scalable security processes that engineering teams can self-serve
Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning)
Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms
Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage
Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure including manual testing and PoC development
Run vulnerability scans across internal infrastructure and the external perimeter, analyse findings, define remediation, and track issues to closure
Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible
Participate in and help lead red teaming and offensive security exercises
Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams

Requirements

5+ years in application or product security with senior or staff-level impact
Leading security architecture reviews and threat modelling (STRIDE, attack trees, data-flow analysis) across multiple teams or products
Automating and scaling security processes by building tooling, integrations, and self-service workflows
Strong hands-on security testing including code review and web, mobile, and API application security assessments
Ability to triage and validate external vulnerability reports and bug bounty submissions
Strong software engineering ability in at least one language such as Python, Go, or JavaScript
Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices
Experience with SAST, DAST, SCA, and vulnerability management platforms integrated into CI/CD
Strong understanding of REST APIs, microservices, cloud-based systems, and containers
Practical experience applying AI and LLM tooling to security work
Excellent communication and influencing skills with technical and non-technical stakeholders
Self-starter who enjoys automation, mentoring others, and strengthening security culture
Nice to have: securing AI harness, hardening LLM and agent pipelines against prompt injection and data leakage
Nice to have: securing Kubernetes with cluster hardening, RBAC, network policies, and image security
Nice to have: securing AWS infrastructure including IAM, key management, and CSPM
Nice to have: offensive or advanced security certifications such as OSAI, OSEP, OSCP, or OSWE

Conditions

Hybrid working model: 3 days from modern office and 2 days fully remotely
Annual bonus based on the performance review cycle
Generous annual leave policy
Medical insurance and pension fund with additional benefit packages based on location
Comprehensive workation policy with 30 more remote days available
Two additional days of paid leave per year for volunteering efforts

Similar jobs

Similar in meaning, not just matching keywords

This device does not meet the site requirements

What may not work

Senior Application Security Engineer

Job summary

Worth knowing

Description

Responsibilities

Requirements

Conditions

Similar jobs

Job summary

Similar jobs

Senior Application Security Engineer

Job summaryAnalysis and summary of the descriptionGood [data-chart=chart-_R_39f1binpfiv6abqaqlb_] { --color-score: var(--warning); } .dark [data-chart=chart-_R_39f1binpfiv6abqaqlb_] { --color-score: var(--warning); } 62

Job summary

Worth knowing

Description

Responsibilities

Requirements

Conditions

Similar jobs

Job summaryAnalysis and summary of the descriptionGood [data-chart=chart-_R_39f1binpfiv6abqaqlb_] { --color-score: var(--warning); } .dark [data-chart=chart-_R_39f1binpfiv6abqaqlb_] { --color-score: var(--warning); } 62

Job summary

Similar jobs