Crossian

Tóm tắt công việc

About Us

Crossian is a high-growth technology-driven e-commerce business. As a start-up formed in 2020, we have created a fast-paced and dynamic environment, enabling our people to reach a cumulative average growth rate of over 1000% in the last 5 years.

About the role

• We are looking for an Application Security Engineer to embed security into software delivery, assess applications and cloud workloads, and drive vulnerabilities through to verified resolution. You will partner with engineering and DevOps teams to implement practical controls, provide security guidance, and balance risk with business and delivery needs.

Key responsibilities

Secure SDLC & DevSecOps

• Define security requirements, security gates, and design reviews across the design, development, testing, and deployment stages of the SDLC.
• Integrate and automate SAST, DAST, SCA, secret scanning, and container/IaC scanning in CI/CD pipelines; tune findings to reduce false positives and improve developer workflows.

Security assessment & penetration testing

• Assess and penetration-test web and mobile applications, APIs, and backend services using OWASP guidance, with attention to authentication, authorization, and business logic.
• Perform manual and automated security code reviews of high-risk functionality; help developers identify root causes and implement effective remediation.

Vulnerability lifecycle management

• Manage application vulnerabilities from discovery, validation, and risk-based prioritization through remediation, retesting, and closure against agreed SLAs; escalate overdue findings and track approved exceptions.
• Assess risks in third-party libraries, open-source dependencies, and software components using Software Composition Analysis (SCA) and Software Bills of Materials (SBOMs).

Cloud workload security

• Assess and implement security controls for application workloads on cloud platforms such as AWS, Azure, or GCP.
• Partner with DevOps to review containers, Kubernetes, serverless services, IAM/service identities, secrets, and Infrastructure as Code (IaC) against security baselines.

Incident response & collaboration

• Support application security incident investigations and use lessons learned to strengthen preventive controls and development practices.
• Coordinate external penetration tests, including scope definition, findings follow-up, and remediation retesting.
• Provide practical secure coding guidance, training, and support to engineering teams.

• Real ownership over an important part of the company, from day one.
• The chance to help redesign systems that matter.
• A workplace that values results and independent thinking.
• 13th-month salary + performance bonus.
• 15 paid leave days + health insurance.
• Budget to keep learning and growing.