Information Security Engineer, Application Security (Remote - Worldwide)

Open to candidates anywhere; hiring is through a global employer partner where you are not in a main office market. A fast-growing enterprise software company that sells workflow and process orchestration software to large banks and other major organisations is hiring an Application Security engineer for its Information Security team. The team is small and generalist, and works closely with product engineering to make good, risk-based security decisions without slowing delivery. The company is AI-first and uses AI agents in its code review, vulnerability assessment and internal tooling.

What you'll do

• Triage vulnerability findings from dependency, container and code scanners, external reports and internal testing, decide whether the company is actually affected, and agree fix, mitigate or accept decisions with engineering teams.
• Run threat modeling sessions and security design reviews for new features and architecture changes, and turn the results into prioritised actions.
• Use and improve LLM-assisted tooling to review code, validate findings and reproduce issues, applying your own judgement when the model is wrong.
• Build and maintain internal security tooling and automation that connects scanners, engineering teams and customer security communication.
• Review pull requests, improve secure coding guidelines and run occasional workshops for engineers.
• Share an on-call rotation for security incidents, help write customer security advisories and support audits.

What you need

• About 3+ years in security or software engineering, including at least 2 years in application or product security (AppSec, product security, penetration testing or a security-focused developer role).
• Hands-on vulnerability triage experience with tools such as Snyk, Trivy, Semgrep or CodeQL, and the ability to explain exploitability in context (CVSS, configuration).
• Experience with threat modeling and design reviews (e.g. STRIDE) on web apps, APIs or distributed services, ideally at a SaaS company with CI/CD and cloud environments.
• Able to read Java well enough to follow a data flow and spot security bugs, and comfortable writing scripts and small tools.
• Daily use of AI coding tools (e.g. Claude Code, Cursor, Copilot) and an understanding that their output needs security review.
• Clear written and verbal communication with non-security engineers. Strong English is required.

Open to applicants anywhere in the world.

How to apply

Get the free i'llTip app to see the employer's details and apply. i'llTip's AI can tailor your résumé to this job, and you'll get alerts for similar roles.

Prefer the website? Continue on illtip.comOr get the app: Android · iPhone

🔔 Get new jobs like this first: join Tech & AI Jobs on Telegram · or get personal job alerts