Application Security Engineer

The Role

You'll own application security across our mobile banking platform, payments stack, and a growing set of regulated products. The work is hands-on, you'll conduct a threat modeling, security reviews, CI/CD tooling - with real process ownership. You'll report to the Group CISO and work closely with both our engineering teams and the Bank IS function.

Justification

As Salmon expands its product lineup like cards, payments, ATM network - the need for a dedicated Application Security function has become critical. Currently there is no specialist owning secure development practices, mobile security testing, or supply chain risk.

This role fills gap: ensuring internal systems and customer data are protected, embedding security into the product delivery process, and building the AppSec practices needed to meet regulatory expectations and support secure growth.

Responsibilities

Risk-driven security ownership

• Identify which systems, data flows, and product changes carry the highest real-world risk and build your work around that, not around tool coverage or compliance checklists
• Decide when a security gate is worth slowing down a release and when it isn't, own that call, and be able to explain it to engineering and the CISO
• Maintain a risk register for application-layer exposures: what's open, what's accepted, what's being fixed, and why in that order

Secure SDLC

• Figure out where in our delivery process security decisions are actually being made and put controls there
• Run threat modeling for high-stakes product changes before design is locked, not after
• Build a mobile security testing baseline that the team runs themselves

CI/CD and supply chain

• Assess what the current pipeline actually catches versus what it produces as noise, and fix the ratio before adding more scanners
• Own supply chain posture: dependency pinning, SBOM, internal registry, and the response process when a package gets compromised
• Own secrets detection and remediation end-to-end

Regulatory and cross-team work

• Translate application security gaps into language that satisfies BSP examiners without over-engineering the evidence
• Coordinate security input into new product launches across our Group and Bank structure

Requirements

Experience

• 7+ years in application security, with meaningful ownership over both technical work and process
• Has built or substantially improved a secure SDLC in a fast-moving product org
• Has run threat modeling on real product features and influenced design decisions as a result
• Has owned vulnerability management end-to-end: triage, remediation tracking, SLA management, risk acceptance
• Has done hands-on mobile security testing (iOS and/or Android) in a production context, not just UAT
• Understands modern supply chain attack vectors like compromised packages (npm, PyPI), malicious IDE plugins, typosquatting, dependency confusion - and knows how to reduce exposure at the tooling and process level
• Comfortable writing Python or Bash to automate repetitive security work

Technical skills

• SAST, DAST, SCA in CI/CD pipelines: knows how to tune for signal, not just coverage
• API security: authentication flows, token handling, common abuse patterns
• Mobile security: OWASP ASVS/MASVS applied in practice
• Supply chain: SBOM generation and dependency risk management
• Secrets management: detection, remediation, and structural prevention
• Working knowledge of AWS and containers sufficient to understand where application risks extend into infrastructure

Nice to have

• Experience in a regulated environment (financial services or similar)
• Familiarity with PCI-DSS, ISO 27001, or BSP MORB
• Certifications: OSCP, GWEB, GWAPT, CSSLP

Communication

• Strong written English; most day-to-day alignment is async
• Can explain a security issue clearly to an engineer and summarize the same issue for a non-technical stakeholder