Senior) Application Security Engineer

Sygnum is a global digital asset banking group, founded on Swiss and Singapore heritage. We empower professional and institutional investors, banks, corporates and DLT foundations to invest in digital assets with complete trust. Our team enables this through our institutional-grade security, expert personal service and portfolio of regulated digital asset banking, asset management, tokenization and B2B services.

In Switzerland, Sygnum holds a banking licence and has CMS and Major Payment Institution Licences in Singapore. The group is also regulated in the established global financial hubs of Abu Dhabi and Luxembourg.

We believe that the future has heritage. Our crypto-native team of banking, investment and digital asset technology professionals are building a trusted gateway between the traditional and digital asset economies that we call Future Finance. To learn more about how Sygnum's mission and values are shaping this digital asset ecosystem, please visit  and follow us on Linked In and X.

A key pillar of our success are the Sygnum values that define and unite us a team. We proudly call them our SYGN values:

• S stands for the importance we hold in Seeking and seizing opportunities, and the way we take personal ownership for delivering results for our clients;
• Y represents the way we say Yes to maintaining the highest level of integrity and fairness in everything we do. Sygnumers always display confidence without attitude;
• G reminds us to always Grow and win together. We only succeed by supporting each other and challenging ourselves, and our team-mates, to reach for new heights;
• N is here for Nose for value because we are always looking to focus on what matters most to our clients, partners and team.

Sygnum has one of the most diverse teams in the industry. Diversity plays a central role in keeping our work culture open, our teams productive and energised, and our solutions at the forefront of the industry. In the spirit of our SYGN value to "grow and win together", we fully embrace an equal opportunity mindset in the way we onboard, develop and promote our team members.

This is a hands-on technical role for someone who can operate deeply across modern application security disciplines and cloud-native environments. You will contribute to application security across our platform, covering web, mobile, APIs, backend services, and cloud infrastructure, by embedding security into engineering processes, CI/CD pipelines, and runtime environments. Your main responsibilities include:

• Integrate and improve security controls within CI/CD pipelines including SAST, DAST, SCA, and IaC scanning to strengthen Dev Sec Ops  practices
• Configure, operate, and optimise application security tooling, ensuring findings are actionable and integrated into engineering workflows
• Partner with engineering, platform, and product teams to design and implement secure-by-design architectures, perform threat modelling and promote secure development practices
• Evaluate open-source dependencies and contribute to software supply chain security initiatives
• Assess and secure AI-enabled applications and services, including AI/LLM integrations, AI supply chain risks, model security controls, and secure deployment patterns
• Review and harden Infrastructure-as-Code implementations to enable secure cloud deployment patterns and reusable guardrails
• Assess the security design of smart contracts, blockchain integrations, and third-party Web3 services
• Partner with SOC and engineering teams to improve detection, alerting, and response capabilities for application-layer threats.

You are an experienced technical security expert who can demonstrate the following skills and experience:

• 5-7+ years of deep, hands-on experience in application security or Dev Sec Ops  in modern engineering environments
• Strong experience securing cloud-native architectures (AWS and Azure preferred)
• Deep understanding of Kubernetes security, containers, and IaC security
• Experience reviewing Infrastructure-as-Code and performing secure code reviews across backend, web, and/or mobile applications
• Practical knowledge of application security standards, e.g., OWASP…