Job Description:

We are seeking a hands-on Security Engineer to own the security of a large, business-critical web application built on C# / .NET backends.
This is not only a policy or audit role. You will read and write code, find vulnerabilities, fix them, and make sure they stay fixed. You will be the go-to person for authentication, authorization, cryptography and secure API design, and you will work side by side with our developers and DevOps engineers to build security into every stage from commit to production. If you enjoy tracing a token through a request pipeline as much as you enjoy closing a finding, we want to talk to you.

Responsibilities:

• Application Security Ownership: Be the accountable owner for the security posture of a large .NET application, from architecture decisions down to individual endpoints.
• Authentication & Identity: Design, implement and harden authentication and authorization flows, including OAuth 2.0, OpenID Connect, JWT issuance and validation, refresh-token handling, session management, MFA and role- and policy-based access control in ASP.NET Core.
• Cryptography in Practice: Select and correctly apply cryptographic primitives (hashing, symmetric and asymmetric encryption, signing, key derivation), manage keys, secrets and certificates, and eliminate weak or misused crypto in the codebase.
• Find & Fix: Perform code reviews, threat modeling and hands-on vulnerability testing; reproduce issues, write the fix in C#, and add tests that prevent regressions.
• DevSecOps Collaboration: Work with the DevOps team to embed security into CI/CD pipelines: SAST, DAST, dependency and container scanning, secret detection and secure build and release gates.
• Vulnerability Management: Triage findings from scanners, pentests and bug reports; prioritize by real risk and drive them to closure with the responsible teams.
• Secure API Design: Define and enforce standards for input validation, output encoding, rate limiting, CORS, security headers and safe error handling across our services.
• Incident Response: Investigate security incidents, analyze logs and traces, contain issues and lead post-mortems with concrete follow-up actions.
• Enablement: Write secure-coding guidelines, reusable libraries and examples; coach developers so that the secure way is also the easy way.

Qualifications & Requirements:

• Education: At minimum a bachelor's degree in Computer Science, IT Security or a related field.
• Backend Expertise: Proven, hands-on experience building and maintaining C# / .NET (ASP.NET Core) backends in production.
• Identity & Access: Deep practical knowledge of OAuth 2.0, OpenID Connect, JWT (claims, signing algorithms, validation pitfalls), cookies vs. tokens, and authorization models (RBAC, ABAC, policy-based).
• Applied Cryptography: Solid understanding of TLS, hashing (incl. password hashing such as bcrypt, scrypt, Argon2, PBKDF2), symmetric and asymmetric encryption, digital signatures, certificates and secure key storage.
• Web Security: Strong command of the OWASP Top 10 and OWASP API Security Top 10, and experience exploiting and fixing issues such as injection, XSS, CSRF, SSRF, IDOR and broken access control.
• Security Tooling: Hands-on experience with SAST/DAST and dependency scanning tools (e.g. SonarQube, Snyk, OWASP ZAP, Burp Suite, GitHub Advanced Security or similar).
• CI/CD & Containers: Working knowledge of CI/CD pipelines and Docker, enough to collaborate effectively with DevOps on secure pipelines and images.
• Scripting: Comfortable automating tasks with PowerShell, Python or Bash.
• Soft Skills: Ownership mentality, pragmatic risk judgment, and the ability to explain security issues clearly to developers and stakeholders without slowing delivery unnecessarily.

Certifications (Optional, Most Welcome)
Certifications are not required, but entry-level security and Azure credentials are a strong plus.

Security

• CompTIA Security+
• ISC2 Certified in Cybersecurity (CC)
• Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
• Further practical credentials (e.g. eJPT, CompTIA PenTest+) are a bonus

Microsoft Azure

• Microsoft Certified: Azure Fundamentals (AZ-900)
• Microsoft Certified: Azure Developer Associate (AZ-204)
• Microsoft Certified: Azure Security Engineer Associate (AZ-500) (a strong plus)

Optional But Welcome Skills

• Microsoft Azure: Experience with Entra ID (Azure AD), Key Vault, Managed Identities, App Service, Defender for Cloud and network security in Azure.
• React / Frontend Security: Understanding of how React applications work, including client-side token storage, CSP, XSS risks in SPAs and secure frontend-to-API communication.
• Observability for Security: Experience with logging and monitoring tools such as Application Insights, Microsoft Sentinel, Grafana or ELK to detect and investigate suspicious activity.
• Infrastructure as Code: Familiarity with Terraform or Bicep and reviewing IaC for misconfigurations.
• Compliance Awareness: Basic knowledge of GDPR (DSGVO) and standards such as ISO 27001.
• Agile Mindset: Comfort working in an Agile/Scrum environment.