DevSecOps & Application Security Lead

We are looking for a DevSecOps and Application Security Lead to join our team and build our application security from scratch. In this role, you will lead the security direction within our department, focusing on integrating security into the software development process. By balancing automation with practical DevSecOps practices, you will help our engineering teams find and fix vulnerabilities early, ensuring our products are safe and strong without slowing down development.

Responsibilities

Build the DevSecOps/AppSec function from scratch, and create the roadmap, KPIs, and metrics for leadership

Create secure development processes, including release security gates and vulnerability management

Choose, configure, and integrate security scanners (SAST, SCA, secrets) with a focus on automation and AI-assisted workflows

Integrate security checks into pipelines and development processes together with Engineering, DevOps, and Product teams

Run threat modeling and security reviews for high-risk systems and major architecture changes

Create clear security standards, checklists, and practical guidelines for developers (covering code, APIs, and secrets)

Launch and grow a Security Champions program to involve engineers in security processes

Help investigate incidents related to application vulnerabilities, leaked secrets, and supply-chain attacks

Requirements

5+ years of experience in DevOps, SRE, Platform Engineering, or related infrastructure/security roles

3+ years focused on DevSecOps and Application Security

1+ years in a lead/ownership role

Deep understanding of modern software development, Git workflows, and hands-on experience integrating security checks into CI/CD pipelines without creating bottlenecks

Practical experience with SAST, SCA, secrets scanning, and vulnerability management (triage, risk rating, remediation, and validation)

Ability to select and scale security tools based on accuracy, false-positive rates, and developer experience

Strong knowledge of web/API/mobile risks (OWASP Top 10, auth, supply-chain risks) and ability to run threat modeling and secure design reviews

Good scripting skills (Python, Bash, or similar) and understanding of cloud-native/containerized environments

Ability to write clear security requirements and guidelines for developers

English - Intermediate+ or higher

Nice to Have

Experience building AppSec/DevSecOps functions from scratch or early maturity stages

Hands-on experience with tools like Snyk, Aikido, Semgrep, Trivy, Gitleaks, GitHub/GitLab Security, or SonarQube

Experience with cloud/IaC security, Kubernetes, and mobile app security

Knowledge of compliance standards (SOC 2, ISO 27001, PCI DSS, DORA) and experience with Bug Bounty or pentest coordination

Experience with Security Champions programs and AI-assisted security tools

We offer

20 paid vacation days per year

10 paid sick leave days per year

Public holidays as per the company’s approved Public holiday list

Medical budget

Opportunity to work remotely

Professional education budget

Language learning budget

Wellness budget (gym membership, sports gear and related expenses)