Application Security Engineer

About the role

Transak is seeking its first dedicated Application Security Engineer to protect a high‑risk product suite that includes a widget, APIs and flows handling customer funds and identity data. Reporting to the CISO, you will build the application security function from the ground up and ensure compliance with EU regulations such as MiCA and DORA.

Key responsibilities

• Partner with engineering teams to embed security throughout the software development lifecycle.
• Conduct security code reviews, threat‑modelling sessions and architecture reviews for fund‑movement and identity‑data flows.
• Select, implement and tune SAST, DAST and SCA tools to catch vulnerabilities early.
• Build and maintain automated application security testing in CI/CD pipelines with severity‑based gating.
• Own the software supply chain: generate SBOMs, enforce dependency provenance and approve base images.
• Run a consolidated vulnerability register, triage, prioritize and drive remediation to closure.
• Perform penetration testing and vulnerability assessments of web, API and mobile applications.
• Manage the external penetration‑testing programme and coordinate re‑testing.
• Develop secure coding standards, reusable security components and role‑based training.
• Establish a security‑champions programme and run the bug‑bounty initiative.

Required profile

• First dedicated application security hire, reporting directly to the CISO.
• Experience working in regulated environments (e.g., MiCA, DORA).
• Proven ability to design and implement security programmes from scratch.

Required skills

• Node.js
• Python
• SAST, DAST and SCA tooling
• CI/CD pipeline integration
• Software Bill of Materials (SBOM)
• Vulnerability management and remediation
• Penetration testing of web, API and mobile apps
• Bug bounty programme coordination
• Secure coding standards and threat modelling