Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 14 days ago

Senior Application Security Engineer - Product Security & DevSecOps

Duco11 open roles

Where
ul. Marii Curie Skłodowskiej 12 50-381 Wrocław Poland
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Application Security Engineer - Product Security & DevSecOpsDuco · ul. Marii Curie Skłodowskiej 12 50-381 Wrocław Poland

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Duco's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.9% of postings close within 7 days. Measured by our own scanner across the market. Duco postings stay open a median of 64 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 13.9%7 days
  4. 22.4%14 days
  5. 38.1%30 days
  6. 59.0%60 days
This job: posted 14 days ago

Duco median: 64 days open

The posting

About Us

Duco is on a mission to reduce the time spent on data-related work by 90%. Our enterprise data automation platform empowers teams to work more efficiently and meaningfully by giving them the ability to automate data controls with the latest technology, such as no-code, the cloud, and AI.

We help firms to start trusting their data, by giving them one intuitive platform to automate the front-to-back processing of all kinds of data (from structured Excels and RTFs to unstructured PDFs and emails). This eliminates the boring manual work across the data lifecycle and enables firms to act faster, work smarter, save money, reduce risk and comply with regulatory requirements.

We’re headquartered in London and have offices in New York, Wroclaw, Singapore, and Antwerp. We’re proud to call some of the largest global financial institutions our clients, including over 15 of the world’s largest international banks, as well as brokers, exchanges, asset managers, hedge funds, administrators, service providers and corporates.

The opportunity

We are seeking an experienced Senior Application Security Engineer to take ownership of security across our software development lifecycle (SDLC). In this role, you will establish secure delivery as the default for our engineering teams, from design and code through to the pipelines that release it.

You will own our Application Security Posture Management (ASPM) platform, Ox Security, and ensure its findings translate into effective remediation. This includes reducing noise, prioritising vulnerabilities that are genuinely exploitable and partnering closely with engineering teams to resolve them. You will also define our approach to threat modelling, security testing and the integration of security guardrails into our CI/CD pipelines.

You will join a small, collaborative Information Security team based across London and Wrocław, working alongside our Senior Security Engineer (Cloud & SecOps) and our Governance, Risk and Compliance (GRC) function. You will work closely with our Engineering teams on a day-to-day basis and report to the Head of Information Security.

Key responsibilities

Secure SDLC and pipeline security

  • Own security across our SDLC and CI/CD pipelines, embedding secure delivery as the default
  • Build and maintain pipeline security guardrails, including static application security testing (SAST), software composition analysis (SCA), secrets scanning, and infrastructure-as-code (IaC) and container image scanning, with gating policies agreed with Engineering
  • Strengthen software supply chain security, including dependency hygiene, software bills of materials (SBOMs) and build provenance
  • Define pre-deployment cloud guardrails through policy-as-code, in partnership with our Senior Security Engineer (Cloud & SecOps)

Vulnerability management and remediation

  • Own Ox Security as our ASPM platform, including policy tuning, noise reduction and the prioritisation of findings based on reachability and exploitability
  • Drive remediation with engineering teams, agreeing remediation service level agreements (SLAs) with engineering leads and reporting clearly on progress
  • Scope and coordinate application penetration testing, tracking findings through to remediation

Secure design and engineering enablement

  • Lead threat modelling for new features and significant architectural changes
  • Conduct secure design reviews and review high-risk code changes
  • Promote secure coding practices through practical guidance, training and a security champions network across Engineering

Client assurance, reporting and threat awareness

  • Represent our platform security with confidence in client security reviews and due diligence discussions, alongside the Head of Information Security
  • Maintain and report application security metrics that inform risk reporting and key risk indicators (KRIs)
  • Support audits and client assurance activities with clear evidence of our secure development and release practices
  • Monitor emerging application and supply chain threats, including those affecting AI and agentic capabilities

Skills and experience

  • Proven experience in an application security, product security or DevSecOps role, ideally within a SaaS environment
  • Hands-on experience integrating security tooling into CI/CD pipelines
  • A track record of converting SAST, SCA, secrets or ASPM findings into prioritised, remediated work rather than raw reporting
  • Strong understanding of common vulnerability classes and the OWASP Top 10, with practical knowledge of how to remediate them
  • The ability to read and review code in at least one of our core languages: Java, Ruby or Python
  • Experience facilitating threat modelling with engineering teams
  • Working knowledge of AWS and infrastructure-as-code
  • Proficiency in Python or a comparable scripting language for automation
  • Credibility with developers, with the ability to influence engineering teams and articulate risk in actionable terms

Desirable

  • Hands-on experience with Ox Security or another ASPM platform
  • A background in software engineering prior to moving into security
  • Software supply chain security experience, such as Supply-chain Levels for Software Artifacts (SLSA), SBOMs or artefact signing
  • Container and Kubernetes security experience, including image scanning and admission controls
  • Experience with policy-as-code tooling
  • Experience establishing a security champions programme
  • Experience securing large language model (LLM) or agentic AI capabilities, such as applying the OWASP Top 10 for LLM Applications
  • Familiarity with financial services regulations and standards, such as the Digital Operational Resilience Act (DORA), ISO 27001 and SOC 2
  • Relevant professional certifications, such as OSWE, GWAPT, CSSLP or AWS Certified Security – Specialty

The reward package

  • Competitive salary package aligned with your skills and experience, reviewed annually.
  • Success Share bonus payments.
  • Private Medical Insurance – Enel Med.
  • Life Insurance.
  • Multisport Program.
  • Unlimited annual holiday, because we trust our people to manage their own time off.
  • Enhanced family leave.
  • Employee Assistance Programme.
  • 4 volunteering days off.
  • Hybrid working policy – 2 days in the office.
  • Referral bonus if we hire someone great who you've recommended to us.
  • Spot Rewards.
  • EAP Wellbee.

Want to do a little more research before you apply?

Head over to our Glassdoor page to learn about our benefits, culture and to find out what our team thinks about life at Duco. You can also find out more about us on LinkedIn

Disclaimer

Because we are committed to inclusivity, we strive to provide equitable opportunities for everyone. If you require accommodation during the recruitment process, please let us know at [email protected]. Include your contact information, the role you're applying for, and how we can accommodate you.

During the interview process and after hire, Duco does not discriminate on the basis of race, colour, gender or gender expression, sexual orientation, marital or pregnancy status, national origin, age, disability, religion or creed, socioeconomic background or status, size, or any other protected characteristic.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Duco's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Duco's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Duco's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.