Senior Application Security Engineer

About the role

inDrive is looking for a Senior Application Security Engineer for its AppSec team. You will own whole areas of the AppSec program, from security requirements and design reviews to controls that work in production, working with product, platform and infrastructure teams on new architecture, AI systems and the security of apps and services. The role suits a hands-on engineer who reviews code and architecture, leads work across several teams and makes security decisions based on data.

Key responsibilities

• Own one or more areas of the AppSec program end to end, including the plan, the risks and the metrics.
• Run security design reviews and threat modeling of new features, services and AI systems, and defend security requirements at the architecture committee.
• Assess the security of web, mobile and API applications and find variants of confirmed vulnerabilities across other services.
• Coordinate external security assessments and bug bounty findings, from triage and prioritisation with teams to fix verification.
• Design secure authentication and authorization between users, services and internal tools together with platform teams.
• Choose, pilot and tune security tools, keeping only those that deliver real findings.
• Turn incidents and assessment results into lasting controls, policies and secure defaults for developers.
• Consult development teams on complex security issues and take shifts in AppSec duty for Critical and High incidents.

Required profile

• Higher education in IT, preferably in information security.
• Experience leading projects with two or more teams from requirement to verified fix, and clear written English.
• Nice to have: knowledge of software supply chain security, dependencies, CI/CD pipelines and source control hardening; experience tuning SAST, DAST and SCA tools.

Required skills

• Mobile security on Android and iOS, client-server trust, app integrity, bot and account takeover protection.
• Web and API security, including authentication and authorization flaws, SSRF, injections and business logic issues.
• Identity and access: OAuth 2.0, OIDC, JWT, signing key rotation, mTLS, SSO.
• AI system risks such as prompt injection and excessive tool permissions.
• Cloud-native infrastructure: Kubernetes, containers, API gateways, AWS.
• Vulnerability management, risk and severity, SLA, compensating controls and risk acceptance.
• Ability to read and review code in at least one language, preferably Golang.
• Secrets and key management, rotation and response to credential leaks.

What we offer

• Annual salary from 70,700 EUR gross; final benefits may vary by location.
• Mentoring, career consulting and learning programs.
• Global Talent Exchange Program with international collaboration.
• Co-financed language courses and internal speaking clubs.