Company Overview

The organisation develops technology-enabled financial services in an environment where application security, data protection, and operational resilience are fundamental to customer confidence. Its digital platforms may include web applications, backend services, APIs, payment integrations, and systems responsible for handling sensitive financial and account information.

The security engineering function works alongside software developers, infrastructure teams, and operational stakeholders to identify vulnerabilities early, improve secure development practices, and reduce risks throughout the software delivery lifecycle. Rather than treating security as a final checkpoint, the team promotes an approach in which secure design, automated testing, and risk-based remediation are incorporated into everyday engineering activities.

This remote role offers an opportunity for a technically capable security professional to contribute directly to the protection of financial applications and the systems that connect them.

Role Summary

The Application Security Engineer will assess application security risks, identify weaknesses in software and API implementations, and work with engineering teams to implement effective remediation. The position combines secure code review, application testing, threat modelling, vulnerability management, and security automation.

The successful candidate will help integrate security checks into development pipelines and support engineering teams in understanding how vulnerabilities arise, how they can be exploited, and how they should be addressed. Particular attention will be given to authentication and authorisation, API access controls, sensitive data handling, dependency security, and common weaknesses in web and backend applications.

The role requires practical technical judgement. The engineer must be able to distinguish theoretical findings from exploitable risks, prioritise remediation according to business impact, and recommend solutions that strengthen security without unnecessarily obstructing software delivery.

Key Responsibilities

• Conduct application security assessments of web applications, backend services, APIs, and other components used within financial technology platforms.

• Perform secure code reviews to identify vulnerabilities involving authentication, authorisation, input validation, session management, cryptography, and sensitive data exposure.

• Apply established security testing methodologies, including relevant OWASP guidance for web applications and APIs.

• Develop threat models for new features, system integrations, and architectural changes, identifying attack surfaces, trust boundaries, and potential abuse scenarios.

• Work with developers to investigate and remediate vulnerabilities, providing clear technical explanations and practical recommendations.

• Integrate automated security testing into CI/CD pipelines, including static application security testing, software composition analysis, and suitable dynamic testing.

• Assess third-party libraries, open-source dependencies, and software components for known vulnerabilities and maintenance risks.

• Review API security controls, including token validation, permission enforcement, rate limiting, request validation, and protection against unauthorised access.

• Support secure handling of financial and customer information through appropriate encryption, data minimisation, secrets management, and access control practices.

• Investigate security findings from vulnerability scanners and testing tools, validate their relevance, and prioritise remediation based on severity and business exposure.

• Collaborate with cloud and infrastructure engineers to review application deployment configurations, service permissions, secrets storage, and relevant security boundaries.

• Maintain security documentation, testing procedures, remediation guidance, and records of significant application security findings.

• Contribute to secure software development standards, developer training, and practical guidance that helps teams avoid recurring security defects.

• Assist with security incident investigations involving applications or APIs by analysing relevant evidence and supporting corrective actions.

• Monitor emerging application vulnerabilities and relevant security advisories, evaluating their potential impact on the organisation’s technology environment.

Requirements and Qualifications

• Degree in Computer Science, Cybersecurity, Software Engineering, Information Technology, or a related field, or equivalent hands-on experience.

• Professional experience in application security, product security, penetration testing, secure software development, or a closely related technical role.

• Strong understanding of web application architecture, HTTP, REST APIs, authentication mechanisms, authorisation models, and common application attack paths.

• Practical knowledge of application security risks, including injection flaws, broken access control, insecure authentication, server-side request forgery, and security misconfiguration.

• Experience with security testing tools and methodologies, such as Burp Suite, OWASP ZAP, static analysis tools, dependency scanners, or equivalent solutions.

• Ability to review code and understand application behaviour in at least one programming language, such as Java, Python, JavaScript/TypeScript, C#, or Go.

• Familiarity with Git, CI/CD pipelines, software development workflows, and methods for integrating security checks into automated delivery processes.

• Understanding of encryption fundamentals, secrets management, secure configuration, logging, and protection of sensitive information.

• Ability to assess vulnerabilities in context, explain their potential impact, and recommend realistic remediation measures.

• Strong analytical and communication skills, including the ability to collaborate with developers and explain security issues in practical terms.

• Experience in fintech, banking, payments, or another environment handling sensitive data is an advantage.

• Relevant qualifications such as CSSLP, OSCP, GWAPT, or other recognised security certifications are beneficial, but practical competence and demonstrable experience remain important.

Benefits

• Remote working arrangements within Estonia, subject to the organisation’s employment policies.

• Opportunity to contribute to the security of digital financial applications, APIs, and supporting technology infrastructure.

• Collaboration with engineering and infrastructure professionals to embed security into software design and delivery.

• Opportunities to develop expertise in application security testing, API protection, threat modelling, and security automation.

• Access to professional development, technical learning, and relevant security training.

• A working environment that encourages evidence-based security decisions, responsible disclosure of weaknesses, and continuous improvement.

• The opportunity to influence secure engineering standards and reduce application risk across the software development lifecycle.

Application Instructions

Candidates should submit a CV outlining their application security experience, programming knowledge, testing tools, and familiarity with secure development practices. Applicants may include examples of relevant projects, such as an application assessment, API security review, secure code review, or security automation initiative. Any examples must exclude confidential information, proprietary source code, and sensitive details belonging to previous employers or clients.

Applications should be submitted through the relevant recruitment platform or official hiring channel associated with the vacancy. Shortlisted candidates may be invited to complete a technical assessment and participate in interviews covering vulnerability analysis, secure coding, threat modelling, and communication of remediation recommendations.

Are you interested in this position?

Apply by clicking on the “Apply Now” Button below!

#JobsHubEstonia #GlobalRecruitment
#CareerOpportunities #HiringNow
#JobSeekersNetwork #EstoniaJobs
#RecruitmentServices #EmploymentPortal.