Application security engineer

Are you passionate about application security and helping engineering teams build secure, resilient applications? We are collaborating with a leading European Online Fashion & Beauty Retailer to find a highly capable and self-driven Application Security Engineer to support its growing security needs. This role is centered around threat modeling, application security architecture, and technical design reviews. You’ll work closely with software engineers and architects to identify potential security risks, validate AI-assisted threat modeling results, and provide practical, actionable recommendations to strengthen application security across the organization.

You’ll also have the opportunity to contribute to securing AI-powered solutions and modern cloud-native applications.

Conduct structured threat modeling for web applications and other application types, using established methodologies such as STRIDE. Review and validate threat modeling outputs generated by AI-assisted tools, identifying potential gaps and providing actionable security recommendations. Perform application security architecture and technical design reviews to identify security risks early in the development lifecycle. Recommend secure design patterns and practical mitigation strategies for application security risks.

Review and advise on authentication and authorization mechanisms, API security, token management, and secrets handling. Collaborate closely with software engineers and architects to integrate security best practices into application design and development. Provide clear, developer-friendly guidance on implementing security controls and remediating identified risks. Assess security risks in AI/LLM-based applications and architectures, providing recommendations to help teams develop secure AI-powered solutions.

Apply relevant security standards and best practices, including OWASP Top 10 for Web Applications and OWASP Top 10 for LLM Applications.

5–10 years of professional experience in Application Security. Strong hands‑on experience with manual threat modeling and threat modeling methodologies such as STRIDE. Experience reviewing and validating AI‑assisted or automated threat modeling outputs. Proven experience in application security architecture and technical design reviews. Strong understanding of secure software design principles, security controls, and risk mitigation strategies. Good knowledge of OWASP Top 10 for Web Applications and REST API security best practices.

Experience with modern authentication and authorization protocols, including OAuth
2.0/2.1, OpenID Connect (OIDC), JWT/JWS/JWE, mTLS, and SAML. Understanding of authorization models such as RBAC and ABAC, as well as policy‑as‑code approaches and tools like Open Policy Agent (OPA), Rego, or Cedar. Familiarity with modern cloud‑native application architectures and common backend technologies. Ability to communicate security risks clearly and provide practical, actionable recommendations to software engineers and architects. Strong analytical and problem‑solving skills, with the ability to work independently and collaborate effectively with cross‑functional teams.

Experience with AI/LLM application security and knowledge of the OWASP Top
10 for LLM Applications;
Familiarity with IDE or CI/CD integrations and automated or LLM‑assisted threat modeling tools;
Experience assessing the security of AI‑powered solutions and reviewing AI system architectures.

This is an independent contractor opportunity based on a direct contractual relationship between Zoolatech and the individual service provider. To facilitate this direct partnership, we engage with professionals who are registered and operate as a sole proprietorship, private entrepreneur, or an equivalent self‑employment status in your country. Please note, our model does not accommodate contracts through third‑party intermediaries such as agencies, incubators, or umbrella companies.

The essential requirement is your ability to enter into a service agreement and invoice Zoolatech directly. This is not an offer of direct employment.