About the Role
Iyuno is looking for a Senior Application Security Engineer to help build and scale application security across our internal platforms and B2B SaaS applications. This is a hands-on technical role that will work closely with our development and engineering teams throughout the software development lifecycle. You will help identify and validate vulnerabilities, work directly with developers to drive remediation, and build the automation, tooling, and security guardrails that help prevent security issues from reaching production.
Responsibilities
•Perform secure code reviews and help identify vulnerabilities before they reach production.
•Partner with developers to validate findings, understand root causes, and provide practical remediation guidance.
•Support secure design and threat modelling for higher-risk features and architectural changes.
•Help establish secure development standards and scalable "paved road" patterns across engineering teams.
•Triage findings from bug bounty platforms, security testing, and other sources.
•Prioritise vulnerabilities based on exploitability, technical context, and business impact.
•Work directly with engineering teams to drive findings through remediation and verification.
•Identify recurring vulnerability patterns and help implement controls that prevent them from reoccurring.
•Build and improve automation, security checks, and developer guardrails throughout the SDLC.
•Maintain and evolve internal AppSec tooling, including MCP-based security capabilities and OWASP-aligned checks.
•Explore practical uses of AI for vulnerability discovery, validation, prioritisation, remediation, and secure code review.
•Improve security integration within CI/CD and developer workflows.
•Help secure third-party dependencies, build pipelines, containers, secrets, and software artifacts.
•Review infrastructure as code and cloud application configurations for security weaknesses.
•Consume and act on relevant findings from cloud security posture management and similar security platforms.
•Partner with application, platform, and infrastructure teams on risks that cross technical boundaries.
•Serve as a trusted application security partner to engineering teams.
•Provide guidance on secure coding, architecture, and application security best practices.
•Help developers understand how vulnerabilities occur and how to prevent them.
•Improve security practices without creating unnecessary friction or becoming a bottleneck.
Requirements
•Strong hands-on experience in application security within modern software engineering environments.
•Experience identifying and validating web application and API vulnerabilities.
•Experience reviewing source code and working directly with developers on remediation.
•Strong understanding of OWASP guidance, secure development practices, and threat modelling.
•Familiarity with SAST, DAST, SCA, secrets scanning, and other application security testing approaches.
•Experience with software supply chain security, CI/CD, cloud environments, and infrastructure as code.
•Experience with vulnerability management, bug bounty, or penetration testing programs.
•Ability to automate security workflows using scripting or software development skills.
•Ability to separate meaningful security risk from scanner noise.
•Strong communication skills and the ability to influence engineering teams without direct authority.
Conditions
No conditions were stated in the posting.
