Application Security Engineer (m/w/d)

Job Description:

We are seeking a hands-on Security Engineer to own the security of a large, business-critical web application built on C# / .NET backends.
This is not only a policy or audit role. You will read and write code, find vulnerabilities, fix them, and make sure they stay fixed. You will be the go-to person for authentication, authorization, cryptography and secure API design, and you will work side by side with our developers and DevOps engineers to build security into every stage from commit to production. If you enjoy tracing a token through a request pipeline as much as you enjoy closing a finding, we want to talk to you.

Responsibilities:

• Application Security Ownership: Be the accountable owner for the security posture of a large .NET application, from architecture decisions down to individual endpoints.
• Authentication & Identity: Design, implement and harden authentication and authorization flows, including OAuth 2.0, OpenID Connect, JWT issuance and validation, refresh-token handling, session management, MFA and role- and policy-based access control in ASP.NET Core.
• Cryptography in Practice: Select and correctly apply cryptographic primitives (hashing, symmetric and asymmetric encryption, signing, key derivation), manage keys, secrets and certificates, and eliminate weak or misused crypto in the codebase.
• Find & Fix: Perform code reviews, threat modeling and hands-on vulnerability testing; reproduce issues, write the fix in C#, and add tests that prevent regressions.
• DevSecOps Collaboration: Work with the DevOps team to embed security into CI/CD pipelines: SAST, DAST, dependency and container scanning, secret detection and secure build and release gates.
• Vulnerability Management: Triage findings from scanners, pentests and bug reports; prioritize by real risk and drive them to closure with the responsible teams.
• Secure API Design: Define and enforce standards for input validation, output encoding, rate limiting, CORS, security headers and safe error handling across our services.
• Incident Response: Investigate security incidents, analyze logs and traces, contain issues and lead post-mortems with concrete follow-up actions.
• Enablement: Write secure-coding guidelines, reusable libraries and examples; coach developers so that the secure way is also the easy way.

Qualifications & Requirements:

• Education: At minimum a bachelor's degree in Computer Science, IT Security or a related field.
• Backend Expertise: Proven, hands-on experience building and maintaining C# / .NET (ASP.NET Core) backends in production.
• Identity & Access: Deep practical knowledge of OAuth 2.0, OpenID Connect, JWT (claims, signing algorithms, validation pitfalls), cookies vs. tokens, and authorization models (RBAC, ABAC, policy-based).
• Applied Cryptography: Solid understanding of TLS, hashing (incl. password hashing such as bcrypt, scrypt, Argon2, PBKDF2), symmetric and asymmetric encryption, digital signatures, certificates and secure key storage.
• Web Security: Strong command of the OWASP Top 10 and OWASP API Security Top 10, and experience exploiting and fixing issues such as injection, XSS, CSRF, SSRF, IDOR and broken access control.
• Security Tooling: Hands-on experience with SAST/DAST and dependency scanning tools (e.g. SonarQube, Snyk, OWASP ZAP, Burp Suite, GitHub Advanced Security or similar).
• CI/CD & Containers: Working knowledge of CI/CD pipelines and Docker, enough to collaborate effectively with DevOps on secure pipelines and images.
• Scripting: Comfortable automating tasks with PowerShell, Python or Bash.
• Soft Skills: Ownership mentality, pragmatic risk judgment, and the ability to explain security issues clearly to developers and stakeholders without slowing delivery unnecessarily.

Certifications (Optional, Most Welcome)
Certifications are not required, but entry-level security and Azure credentials are a strong plus.

Security

• CompTIA Security+
• ISC2 Certified in Cybersecurity (CC)
• Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
• Further practical credentials (e.g. eJPT, CompTIA PenTest+) are a bonus

Microsoft Azure

• Microsoft Certified: Azure Fundamentals (AZ-900)
• Microsoft Certified: Azure Developer Associate (AZ-204)
• Microsoft Certified: Azure Security Engineer Associate (AZ-500) (a strong plus)

Optional But Welcome Skills

• Microsoft Azure: Experience with Entra ID (Azure AD), Key Vault, Managed Identities, App Service, Defender for Cloud and network security in Azure.
• React / Frontend Security: Understanding of how React applications work, including client-side token storage, CSP, XSS risks in SPAs and secure frontend-to-API communication.
• Observability for Security: Experience with logging and monitoring tools such as Application Insights, Microsoft Sentinel, Grafana or ELK to detect and investigate suspicious activity.
• Infrastructure as Code: Familiarity with Terraform or Bicep and reviewing IaC for misconfigurations.
• Compliance Awareness: Basic knowledge of GDPR (DSGVO) and standards such as ISO 27001.
• Agile Mindset: Comfort working in an Agile/Scrum environment.

Qualifications & Requirements:

Education:

• Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, or a related field required (as the baseline requirement)
• Master’s degree in Computer Science, Cybersecurity, or Information Technology strongly recommended

Work Experience: 7+ years of experience in Cloud Architecture, Cybersecurity, and/or DevSecOps roles

Execution & Drive: Self-motivated, hands-on practitioner with a "doer" mentality, taking strong personal ownership and pride in the quality, security, and elegance of technical deliverables

Technical Leadership: Proven ability to lead, mentor, and inspire engineering teams to continuously raise the bar and strive for excellence

Public Internet Exposure: Hands-on experience defending public-facing, internet-exposed applications against threats (e.g., volumetric DDoS, credential stuffing, API abuse, SQLi)

Azure Technical Stack: Strong practical knowledge of Microsoft Azure services and security tools (Defender for Cloud, Microsoft Entra ID, Azure Key Vault, Azure Policy, Network Security Groups, Private Endpoints)

DevOps Architecture & Infrastructure as Code (IaC): Experience in driving automated infrastructure provisioning, continuous deployment, and telemetry across hybrid Azure, on-premises, and Kubernetes environments, ensuring zero-downtime deployments, high availability, and operational resilience

Software & Distributed Architecture Expertise: Strong background in software architecture with proven experience designing and securing microservices architectures. Solid understanding of distributed systems, event-driven messaging systems (e.g., RabbitMQ, Kafka, Azure Service Bus), data persistence patterns, and API gateway integrations

Certifications (Associate & Expert level welcome)

• Microsoft Azure Associate Certifications (Preferred/Targeted): Azure Security Engineer Associate (AZ-500), Azure Administrator Associate (AZ-104), Azure Developer Associate (AZ-204), Azure Network Engineer Associate (AZ-700)
• Expert / Industry Certifications (A plus): Microsoft Certified: Cybersecurity Architect Expert (SC-100), Microsoft Certified: Azure Solutions Architect Expert (AZ-305), Certified Kubernetes Security Specialist (CKS) or CISSP