Senior Application Security Engineer

📋 Job Overview

We are hiring a Senior Application Security Engineer to own application security across Product Engineering and make Treatwell's products secure by default. You will work hands-on with engineering teams to remediate vulnerabilities in our codebases and build secure defaults into our development processes.

🏢 About Treatwell

Treatwell is a company that provides technology solutions for the beauty and wellness industry. We are looking for a security engineer who can help us build secure products and processes across our engineering organization.

🎯 The Role

This is a hands-on role where you will own application security across Product Engineering. You will work with teams to fix vulnerabilities, build security tooling, and make secure development practices the default. Our applications include Java and Spring Boot, Ruby on Rails, React and TypeScript, native iOS and Android apps, and some PHP. We use GitLab CI and ArgoCD for deployment, and everything is monitored in Datadog.

✅ Key Responsibilities

• Owning application security across Product Engineering and working hands-on with teams to remediate vulnerabilities
• Owning security tooling including SAST, dependency scanning, and DefectDojo
• Making DefectDojo work without manual intervention
• Building secure defaults into development processes
• Running threat modeling sessions with teams
• Triaging security findings and tracking them to closure
• Being the first security contact for application-layer incidents
• Owning security vendor relationships
• Acting as security reviewer for third-party risk assessments
• Measuring and presenting security posture
• Growing the Security Champions program
• Maintaining a security roadmap

📌 Required Qualifications

• Experience as an application security engineer or backend engineer who owned security
• Ability to read and write production code in Java, Ruby, or TypeScript
• Knowledge of OWASP ASVS and Top 10 from a code perspective
• Experience putting security tools into CI pipelines and tuning rules
• Experience with vulnerability management platforms
• Understanding of authentication, sessions, authorisation, and payments flows
• Knowledge of AWS and Kubernetes for application security
• Ability to explain risk in plain language
• Experience transferring security skills to engineering teams
• Experience using AI tooling for security tasks

⭐ Desirable Experience

• Experience in a marketplace, payments, or SaaS business handling card data and personal data
• Bug bounty, CTF, or penetration-testing background
• Experience running or scaling a Security Champions program
• Familiarity with the OWASP DevSecOps Maturity Model
• Experience with WAF, bot protection, secrets management, and infrastructure-as-code scanning
• Knowledge of Spring Security or Rails security internals

🎁 Benefits

• 28 days holiday plus bank holidays
• Monthly €40 Treatwell vouchers
• Mental health support through Open-Up
• Market-specific benefits

🛂 Visa & Eligibility

Treatwell is an 'Open to All' employer and warmly welcomes everybody to the team. We are committed to making reasonable adjustments to the recruitment process as required.