Application Security Engineer (all genders)

Description

You will join a global team of experts in digital business transformation across many industries.

The company combines software, data, AI and human expertise to build digital products, services and operating models that create measurable business value.

International teams of roughly 2,300 to 2,500 experts help clients such as Fortune 500 firms, global market leaders and SMEs get more from their digital initiatives.

The company puts people first and offers a hybrid workplace with a high degree of flexibility.

Responsibilities

• You set up, configure and run Application Security Testing tools, mainly Static Application Security Testing and Software Composition Analysis, for example SonarQube and Black Duck.
• You build these security tools into development workflows and CI/CD pipelines so checks run automatically across the development lifecycle.
• You find, assess and rank vulnerabilities in application code and third-party dependencies, and help developers fix them.
• You write and maintain scan policies, quality gates, rules and reports that keep code secure and aligned with security standards.
• You work with developers, DevOps engineers and other security staff to build security in from the start and raise security maturity across projects.
• You help with threat modeling, application security assessments and ongoing improvements to security testing, so teams ship secure, reliable software.

Requirements

• Hands-on experience in application security.
• Experience with SAST tools such as SonarQube, or similar.
• Experience with SCA tools such as Black Duck, or similar.
• Experience managing and remediating vulnerabilities.
• Knowledge of a secure software development lifecycle (SSDLC) and of integrating security into CI/CD.
• Familiarity with the OWASP Top 10 and secure coding practices.
• Programming skills in Java, Go or Python.
• Nice to have: German language skills.
• Nice to have: Dynamic Application Security Testing (DAST).
• Nice to have: cloud security on Azure or AWS.
• Nice to have: DevSecOps.
• Nice to have: container security.
• Nice to have: software supply chain security.
• Nice to have: threat modeling.
• Nice to have: dependency and open-source license compliance.

Conditions

The role offers a hybrid workplace with flexible hours and workation options.

The hiring process has four steps: a first video call, a second interview, and an optional onsite visit in Ingolstadt before a decision.

Applications are judged equally, and the company opposes discrimination and harassment based on any protected characteristic.

Benefits

• Training programs, free language courses, competence centers and an active tech community support your personal and professional growth.
• Hybrid work, workation, flexible hours, parental support and sabbaticals help you balance work and life.
• Sustainability Hub, diverse communities, a Diversity Taskforce and after-work activities.
• Public transport tickets, job bikes, health offers, supplementary insurance, a pension plan and various discounts.