Application Security Engineer

About the role

Addi is building a modern financial platform in Colombia and needs an Application Security Engineer to embed security throughout its product development lifecycle. You will lead the design, implementation, and operation of a Secure Software Development Lifecycle (SSDLC) that protects web, mobile, API, and AI‑enabled services at scale.

Key responsibilities

• Design and roll out a standardized SSDLC across all product lines, targeting >90% coverage of critical business flows and >50% team adoption by end‑2026.
• Establish a consistent threat‑modeling practice using recognized frameworks, ensuring >60% of critical services have documented models before production.
• Own the end‑to‑end application vulnerability management process for code, dependencies, APIs, and mobile apps, achieving >70% remediation of critical issues within SLA.
• Integrate security requirements, testing, and monitoring into CI/CD pipelines.
• Collaborate with development, product, and operations teams to reduce post‑release high‑severity vulnerabilities.

Required profile

• Proven experience designing and operating SSDLC processes in a fast‑moving technology environment.
• Hands‑on expertise in threat modeling and vulnerability management for web, mobile, and API services.
• Ability to drive security adoption across cross‑functional teams and influence engineering practices.
• Strong analytical mindset with a focus on measurable security outcomes.

Required skills

• Secure Software Development Lifecycle (SSDLC)
• Threat modeling
• Application vulnerability management
• CI/CD pipeline integration
• API and mobile security