Senior Application Security Engineer

Job Description

Our US-based client is seeking a Senior Application Security Engineer to join its remote operations team in Sri Lanka.

Your Responsibilities

• Integrate and automate security tools (SAST, DAST, SCA, & secret scanning) into CI/CD pipelines.
• Manage bug bounty programs, including vulnerability triage, validation, & remediation.
• Conduct application security threat hunting to identify exploits, API vulnerabilities, and suspicious activity.
• Perform application penetration testing, code reviews, threat modelling, & security architecture reviews.
• Collaborate with development teams to improve secure coding practices & application security.

Your Qualifications

• 5+ years of experience in Information Security, with strong expertise in Application Security (AppSec) & DevSecOps.
• Hands-on experience managing bug bounty programs using platforms such as HackerOne or Bugcrowd.
• Proven experience integrating security testing tools into CI/CD pipelines (GitHub Actions, GitLab Cl, or Jenkins).
• Strong knowledge of OWASP Top 10, API security, threat modelling, & application vulnerabilities.
• Experience with application security threat hunting & penetration testing.
• Practical knowledge of cloud security (AWS, Azure, or GCP) & container security (Docker/Kubernetes).
• Proficiency in at least one programming or scripting language, such as Python, Go, Java, or JavaScript.
• Familiarity with Al concepts, modern Al-powered development tools, & cloud-based coding environments is highly desirable.
• Strong proactive communicator with excellent English communication skills (both written & verbal), with the ability to collaborate directly with US-based teams.