Application Security Engineer

Application Security Engineer (AppSec) About the Role Tatal is looking for an Application Security Engineer to make sure our applications are secure before they reach production. You'll work closely with our engineering teams to build security into every stage of the development lifecycle. Key Responsibilities • Conduct security reviews of applications before production deployment • Perform SAST, DAST, dependency, and vulnerability scanning • Assess authentication, authorization, RBAC, and API security • Identify vulnerabilities based on the OWASP Top 10 and OWASP API Security Top 10 • Review secrets management, encryption, and sensitive data handling • Perform security-focused code reviews, prioritizing critical components • Conduct or coordinate penetration testing ahead of major releases • Define security gates and checklists for production releases Requirements • Proven experience securing modern SaaS and web applications • Hands-on experience with SAST/DAST and dependency scanning tools • Strong understanding of authentication and authorization (OAuth 2.0, OIDC, JWT) • Solid knowledge of OWASP Top 10 and API security best practices • Ability to work with development teams and explain risks clearly Nice to Have • Experience integrating security into CI/CD pipelines • Security certifications (e.g., OSCP, OSWE, GWAPT) Show more Show less

Proven experience securing modern SaaS and web applications. Hands-on experience with SAST/DAST and dependency scanning tools. Strong understanding of authentication and authorization (OAuth 2.0, OIDC, JWT). Solid knowledge of OWASP Top 10 and API security best practices. Ability to work with development teams and explain risks clearly.

Conduct security reviews of applications before production deployment. Perform SAST, DAST, dependency, and vulnerability scanning. Assess authentication, authorization, RBAC, and API security. Identify vulnerabilities based on the OWASP Top 10 and OWASP API Security Top 10. Review secrets management, encryption, and sensitive data handling. Perform security-focused code reviews, prioritizing critical components. Conduct or coordinate penetration testing ahead of major releases. Define security gates and checklists for production releases.