Application Security Engineer (Red, Blue or Purple Team)

About the role

MUFG Investor Services, a division of Mitsubishi UFJ Financial Group serving public and private funds, is looking for a proactive, collaborative Application Security Engineer who speaks the language of developers and thrives in the purple team space. The role works closely with engineering and IT teams to strengthen the security of applications, APIs and infrastructure through preventative controls and security testing. It is a hybrid position.

Key responsibilities

• Act as a security champion promoting a secure-by-design approach across the business.
• Identify and analyse web application security vulnerabilities and oversee application security platforms, compliance and remediation.
• Run threat modelling and review application architectures early in the SDLC.
• Implement and manage SAST/SCA tooling and scale automated DAST solutions across applications.
• Carry out penetration testing on internal applications and review third-party vendor applications via configuration and hardening checks.
• Validate remediation by development teams and third parties, and coordinate external penetration testing.
• Give security guidance to engineers and build effective collaboration with development and IT teams.

Required profile

• Experience in applications security focused on red, blue or purple team activities.
• Software development experience or contribution to open-source projects.
• Previous close work with development and DevOps teams and security-focused code reviews.
• Preferred: financial sector experience or work in another heavily audited industry.

Required skills

• DAST tools such as Burp Suite, OWASP ZAP or similar.
• SAST/SCA tools such as Snyk, Veracode or Checkmarx.
• One or more of Python, JavaScript.NET or Java.
• REST and GraphQL API testing, GitLab/GitHub, Datadog, Jira, Docker and IDEs.
• Preferred: AWS services (WAF, Cognito), Kubernetes, containers, Open ID Connect, OAuth, custom CI/CD security jobs and custom security tooling.