← All roles

Application Security Architect

Capital.com· Security
Apply on company site
Hybrid (Warsaw), Hybrid (Sofia), Hybrid (Limassol)$0HybridPosted 3w ago

About the role

Senior design authority for the security of Capital.com’s web and mobile trading platforms and APIs, owning secure-by-design patterns, threat modelling, and application security baselines across the product portfolio in a hybrid environment.

Responsibilities

  • Define and maintain secure-by-default reference architectures for web apps, mobile backends, microservices, public and partner APIs, and event-driven services
  • Own core application security architecture decisions: authentication and authorisation, session management, API security, secrets management, multi-tenant isolation, and security logging and auditing
  • Lead the redesign of user authentication and the delivery of security features into the product
  • Develop and roll out application security standards, secure-coding guidelines, configuration standards, reusable design patterns, and architecture decision records (ADRs) for engineers
  • Define internal policies for the safe use of AI-assisted and vibe-coding tools
  • Define security requirements for acquired technology and guide its secure integration
  • Establish and run a threat-modelling operating model across product risk tiers
  • Own the security review stage of the new product approval process (architecture and configuration)
  • Lead design reviews for high-impact initiatives (new products, auth flows, payments, data flows, platform migrations, major refactors)
  • Identify design-level risks and agree practical mitigations with engineering teams
  • Assess current AppSec state, drive secure SDLC strategy with Engineering and Security leadership
  • Oversee AppSec tooling strategy (SAST, DAST, IAST, SCA, secrets scanning) and workflow of findings
  • Embed security controls as guardrails in CI/CD via policy-as-code
  • Collaborate with DevOps on repository management and supply-chain security (SBOMs, safe component usage, build integrity)
  • Improve security of internal tools

Qualifications

  • 8+ years in technology
  • 5+ years in a dedicated application or product security role
  • strong engineering background and hands-on architecture or design ownership
  • proven track record creating, documenting, and rolling out security standards and patterns
  • deep, demonstrable threat-modelling experience across product portfolios
  • experience designing and implementing a secure SDLC in a cloud-native environment
  • strong AWS knowledge; exposure to GCP or other clouds welcomed
  • strong command of OWASP Top 10, ASVS; experience with AppSec tooling (SAST, DAST, IAST, SCA, secrets scanning)
  • deep understanding of microservices, REST/GraphQL APIs, event-driven systems, OAuth2/OIDC, Docker & Kubernetes

Skills

Required:Application security architectureThreat modellingSecure SDLC / DevSecOps

Benefits

  • Hybrid working model (3 days in office, 2 remote)
  • Annual Bonus based on performance
  • Generous Annual Leave
  • Medical Insurance and Pension fund with location-based benefits
  • Comprehensive Workation Policy with 30 remote days
  • Possibility of two additional paid volunteering days per year
Last updated Oct 21, 2026. Interested? Apply on the company site.

About Capital.com

Trade with a trusted global broker

Join 770,000+ traders on our award-winning platform, offering CFDs & spread betting on leading markets with advanced tools and support.

CFDsspread betonline trading platforminvestment opportunitiestrading toolsindicators
Company profileWebsite

More open roles at Capital.com