Senior Application Security Engineer

About the role

The Senior Application Security Engineer acts as a technical authority across application and product security. This role is responsible for ensuring secure design, development, deployment, and operation of applications and cloud-native platforms, while partnering closely with engineering teams to embed security throughout the software development lifecycle. You should be comfortable wearing multiple hats and thrive in a fast-paced, collaborative environment.

What you will do

• Define, implement, and mature secure SDLC and application security frameworks across the organization.
• Perform penetration testing and offensive security assessments of web applications, APIs, mobile applications, and cloud environments.
• Conduct manual secure code reviews across technologies such as Java, .NET/C#, Node.js, and Python.
• Lead threat modeling exercises and security architecture reviews for new products, services, and major platform changes.
• Implement and optimize application security tooling, including SAST, DAST, SCA, SBOM management, container scanning, and secrets detection within CI/CD pipelines.
• Manage application vulnerabilities from identification through remediation, working closely with development teams to drive risk reduction.
• Provide guidance and mentorship to development teams on secure coding practices and security best practices.
• Design, maintain, and enforce organization-wide security guardrails, policies, and paved roads.
• Review and strengthen authentication, authorization, identity, and access management controls, including OAuth2, OIDC, and SAML implementations.
• Secure cloud-native environments, including AWS, Kubernetes, and containerized workloads.
• Assess and secure AI-powered and agentic applications, identifying risks such as prompt injection, data leakage, and trust boundary violations.
• Support and lead application-layer incident investigations, performing root cause analysis and driving remediation activities.

What you bring

• 8+ years of experience in Application Security, Product Security, Secure Architecture, or a related cybersecurity field.
• Proven experience performing penetration testing and offensive security assessments.
• Strong expertise in secure code reviews and secure development practices.
• Experience implementing security controls and automation within CI/CD pipelines.
• Strong understanding of web, API, cloud, and microservice security.
• Hands-on experience with Java, .NET/C#, Node.js, or Python, with strong proficiency in at least two.
• Experience with authentication and identity technologies such as OAuth2, OIDC, and SAML.
• Hands-on experience with AWS security services and cloud security best practices.
• Experience working with application security tooling, including SAST, DAST, SCA, and software supply chain security controls.
• Strong stakeholder management and communication skills, with the ability to influence engineering teams and drive remediation efforts.

What sets you apart

• Industry certifications such as OSCP, OSWE, OSEP, OSED, CRTO, CRTP, GWAPT, Burp Suite Certified Practitioner, AWS Security Specialty, CCSP, GCIH, or GCFA.
• Strong Kubernetes and container security expertise.
• Experience with threat modeling methodologies such as STRIDE or PASTA.
• Experience securing AI, machine learning, and LLM-based applications.
• Experience working in highly regulated or compliance-driven environments.

About us

ARRISE is a global leader in software development and services for the iGaming industry, bringing together more than 2,500 professionals operating across more than 12 locations worldwide.

From concept through to delivery, we combine technical expertise, creativity and industry knowledge to develop products, platforms and services that shape player experiences and support some of the industry's leading brands.

We are best known for the work we deliver for Pragmatic Play, creating and supporting technology, products and specialists services enjoyed by millions of players worldwide.