← All roles

Senior Application Security Engineer

Capital.com· Security
Apply on company site
Hybrid (Warsaw), Hybrid (Sofia)HybridPosted 3w ago

About the role

Senior/Staff Application Security Engineer focused on designing, automating, and scaling security processes across Capital.com's product and infrastructure. Combines hands-on offensive/defensive security with engineering mindset to enable secure-by-default development across multiple teams.

Responsibilities

  • Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to scale reviews across teams
  • Act as a security force multiplier by influencing standards, patterns, and guardrails
  • Design, build, and automate scalable security processes that engineering teams can self-serve (secure design review, threat modelling, testing, remediation workflows)
  • Integrate and automate security checks across SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, IaC)
  • Own and evolve security tooling (DefectDojo, SAST/DAST/SCA platforms) to maximise automation and integration
  • Apply AI/LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage
  • Conduct and oversee security assessments of web/mobile apps, APIs, and cloud infrastructure
  • Run vulnerability scans across internal and external perimeters, analyse findings, define remediation, track to closure
  • Support and triage Bug Bounty program and external reports; automate triage where possible
  • Participate in and help lead red teaming and offensive security exercises
  • Drive knowledge sharing on secure development, mentor engineers, and deliver training to development and QA teams

Qualifications

  • 5+ years in application or product security, or equivalent depth, with senior or staff-level impact
  • Experience leading security architecture reviews and threat modelling across multiple teams or products
  • Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort
  • Strong hands-on security testing skills (code review, web/mobile/API assessments) and triage of external reports/bounty submissions
  • Software engineering ability in at least one language (Python, Go, JavaScript) with ability to build automation
  • Deep understanding of OWASP Top Ten, secure design and coding practices
  • Experience with SAST, DAST, SCA, vulnerability management platforms and CI/CD integration
  • Strong understanding of REST APIs, microservices, cloud-based systems, and containers
  • Experience applying AI/LLM tooling to security work or demonstrated aptitude to do so
  • Excellent communication and influencing skills; self-starter who enjoys automation and mentoring

Skills

Required:Security architectureThreat modellingAutomation / toolingSecurity testingProgrammingCommunication

Benefits

  • Annual Bonus based on performance review cycle
  • Generous Annual Leave Policy
  • Medical Insurance and Pension fund, with location-based packages
  • Hybrid working model (3 days in office, 2 remote)
  • Comprehensive Workation Policy with 30 additional remote days
  • Two additional paid volunteering days per year
Last updated Oct 21, 2026. Interested? Apply on the company site.

About Capital.com

Trade with a trusted global broker

Join 770,000+ traders on our award-winning platform, offering CFDs & spread betting on leading markets with advanced tools and support.

CFDsspread betonline trading platforminvestment opportunitiestrading toolsindicators
Company profileWebsite

More open roles at Capital.com