Application Security Engineer

About the role

ENTERSOFTONE, a business software vendor in SE Europe with more than 1,500 employees, is looking for its first dedicated Application Security Engineer. Reporting to the CISO and working with Information Security Officers, development, DevOps and product teams, you will embed security across the company's ERP, CRM and cloud products, set up security standards and tooling, build a network of security champions and shape the growth of the application security function.

Key responsibilities

• Maintain the Secure Software Development Lifecycle and the secure coding standards behind it
• Conduct threat modeling and security design reviews for new products and major changes, including AI features
• Manage the SAST and SCA platform, optimise developer use and report key metrics
• Decide which security findings block a release and integrate security checks into delivery pipelines
• Triage and prioritise vulnerabilities from SAST, SCA, penetration testing and DAST with Security Operations Analysts and drive remediation
• Support penetration testing and DAST scoping and fix validation, and work with the Security Engineer on WAF exceptions
• Run intake and assessment of vulnerabilities, and provide technical input for security advisories and EU Cyber Resilience Act notifications
• Define Software Bill of Materials (SBOM) requirements and manage software supply chain risk
• Vet secure development training content and support security champions

Required profile

• 5+ years in software engineering or information security, including 3+ years in a dedicated application security role
• Professional software development experience in at least one widely used language
• Strong communication skills, ability to influence engineering practice without authority, excellent written and spoken English
• Knowledge of regulatory obligations for software products, including the EU Cyber Resilience Act, is a plus; experience with ERP or CRM products is a plus
• Professional certifications such as CSSLP, OSWE, GWAPT or OSCP are a plus
• Practical experience with AI tools is a strong advantage

Required skills

• In-depth knowledge of application and API security risks across major vulnerability classes
• Hands-on experience with SAST, SCA, DAST and secrets scanning tools
• Threat modeling and integration of security into CI/CD pipelines
• Penetration testing knowledge sufficient to reproduce, validate and triage findings
• Familiarity with SBOMs, OWASP SAMM, OWASP ASVS and NIST SSDF

What we offer

• Competitive remuneration package
• Private health insurance plan
• Hybrid working model
• Company bus transportation from central stations
• Funded training and development, catering food services