Senior Application Security Engineer

About the role

Forcepoint is seeking a Senior Application Security Engineer to join its Tel Aviv office. In this role you will partner closely with engineering and product teams to embed security throughout the software development lifecycle, proactively identify risks, and ensure secure design, development, and deployment of cloud‑native products. The position follows a hybrid work model with a minimum of two days per week on‑site.

Key responsibilities

• Lead shift‑left security activities, including threat modeling, secure design reviews and definition of secure coding standards (e.g., OWASP Top 10).
• Perform manual and tool‑assisted code reviews, static analysis (SAST), dynamic testing (DAST), and penetration testing; triage, validate and track vulnerabilities.
• Integrate security tools into CI/CD pipelines, automate scanning, reporting and ticketing workflows, and build tooling to scale AppSec across products.
• Leverage AI/ML capabilities to improve vulnerability detection, prioritisation and remediation.
• Assess risk, exploitability and impact of findings, maintain visibility of the security posture and drive remediation efforts.
• Collaborate with developers to explain findings, recommend practical fixes and provide mentorship to junior AppSec team members.
• Act as a security champion across R&D, communicating risk clearly to engineers, product managers and leadership.

Required profile

• Bachelor’s degree in Computer Science, Security or equivalent experience.
• 5+ years of experience in application security or software engineering with a security focus.
• Strong knowledge of web and application vulnerabilities (OWASP Top 10) and secure coding practices.
• Hands‑on experience with threat modeling, architecture reviews and cloud‑native microservices/APIs.
• Professional experience writing, reading and reviewing code, preferably in C++ and Java.

Required skills

• OWASP Top 10
• C++
• Java
• Threat modeling
• Architecture reviews
• ASPM
• SAST
• DAST
• SCA
• CI/CD pipelines
• DevSecOps
• AI/ML for security automation
• Cloud‑native architectures
• Microservices
• APIs