Application Security Engineer

Job description

Founded in 1999 in Vienna, the Qualysoft Group is a manufacturer-independent IT consulting and services company, which successfully provides support for its international customers with the aim of boosting their competitiveness and economic efficiency through innovative IT solutions. Its focus is on financial services providers, telecommunications companies, the automotive industry and energy service providers. Over 400 employees in 6 subsidiaries work together to ensure state of the art solutions for our clients. We are looking for new colleagues in Qualysoft teams for diverse projects providing continuous learning opportunities. Our common goal is to provide honesty, development and a stable background while getting to know the latest technologies. We are waiting for your application for the position below! ### **About the role** We are looking for an **Application/Cloud Security Engineer** to join our team and play a key role in strengthening security across cloud-native environments. In this position, you will work closely with development and infrastructure teams to identify security risks, improve secure development practices, and ensure compliance with relevant security standards. You will have the opportunity to work with modern security tools, cloud technologies, containers, Kubernetes, and threat modelling methodologies in a dynamic, technology-driven environment. ### Responsibilities: - Support and promote **secure software development practices** throughout the SDLC. - Identify, assess, and manage security vulnerabilities using industry-standard security tools and methodologies. - Work with **SAST, DAST, and vulnerability scanning** solutions such as Tenable/Nessus, Rapid7, Aqua Security/Trivy. - Monitor and investigate security events using **SIEM platforms**, including Splunk or Elastic. - Collaborate with development and infrastructure teams to define and implement effective security solutions. - Moderate and facilitate **Threat Modelling workshops** and translate identified risks into actionable mitigation plans. - Contribute to security governance and ensure alignment with relevant **compliance and security standards**. - Support the security of **cloud-native applications, containers, and Kubernetes environments**. - Manage and track security findings and remediation activities using **Jira or similar ticketing systems**. - Analyse complex security findings and provide clear, practical recommendations to technical and business stakeholders. ### Requirements: - Experience with **SDLC and secure development practices**. - Strong knowledge of **application and cloud security** principles. - Hands-on experience with **SAST, DAST, and vulnerability scanning tools**, such as Tenable/Nessus, Rapid7, Aqua Security/Trivy. - Experience with **SIEM solutions**, preferably Splunk or Elastic. - Experience with **Jira or similar ticketing systems**. - Strong understanding of security and compliance standards, such as: - ISO 27001 - SOC 2 - PCI-DSS - IT-Grundschutz - Experience moderating or facilitating **Threat Modelling workshops**. - Deep understanding of **cloud-native development, containers, and Kubernetes**. - Development experience with **Python and/or Golang**. - Exposure to at least one major cloud platform: **AWS, Azure, GCP, or OpenStack**. - Strong analytical and problem-solving skills with the ability to turn complex security findings into clear, actionable plans. - Good communication and collaboration skills.