Senior Application Security Engineer.
SnelStart is looking for a Senior Application Security Engineer for 32 to 40 hours per week, with workplaces in Amersfoort and Alkmaar and a split of 60% on-site and 40% working from home.
SnelStart's SaaS software helps thousands of entrepreneurs with their daily business operations and processes sensitive business data in the process. Finding a vulnerability is step one; making sure it doesn't come back is what this role is about.
As a Senior Application Security Engineer, you make sure security is part of SnelStart's products from the very first design, rather than only being checked or fixed at the end. You work directly with the development teams: you read code, investigate vulnerabilities, and help developers solve problems at the source. At the same time, you improve the surrounding processes, from threat modeling and security requirements to automated checks in CI/CD.
So you won't be a gatekeeper forwarding scan reports from the sidelines. You think along, test things yourself, and build together with developers, architects, SRE, AI Foundry, the CTO, the CISO, and SnelStart's external SOC on software that becomes demonstrably more secure without unnecessarily slowing down development.
What you will do.
The core of the role is application and product security. You will, among other things:
- perform security reviews on designs, code, APIs, authentication and authorization flows, and CI/CD pipelines;
- develop threat models, abuse cases, and concrete security acceptance criteria for new and existing functionality;
- reproduce and prioritize vulnerabilities based on exploitability and actual impact for customers and the organization;
- provide practical support to developers on secure coding and structural solutions, including input validation, secrets, dependencies, sessions, and access rights;
- further integrate SAST, DAST, SCA, secret scanning, and container scanning, and set them up so that teams get actionable signals instead of just more alerts;
- translate findings from pentests and security tests into improvements that prevent recurrence;
- work with cloud, platform, and SOC colleagues to strengthen logging, detection, and response scenarios around the applications;
- where relevant, assess the security of AI functionality and automated workflows, for example regarding prompt injection, data leaks, unsafe tool access, and overly broad agent permissions.
You don't need to be a specialist in every security domain. Application security is your foundation. Experience with cloud, offensive security, detection, or AI security helps you assess risks in their broader context.
What you will build.
In the first year, you'll help establish a recognizable and workable AppSec approach. Think of:
- a clear picture of the main risks in SnelStart's applications, APIs, and software supply chain;
- fixed, lightweight security checkpoints in design, development, and release;
- well-tuned security tools in the pipelines, with clear follow-up on findings;
- practical standards and reusable patterns that enable teams to build more securely on their own;
- more security knowledge within development through coaching, reviews, and hands-on sessions.
The goal is not to introduce as many checks as possible. The goal is that relevant vulnerabilities are found earlier, fixed faster, and recur less often.
What you bring.
You combine technical depth with the ability to bring other engineers along. This includes:
- at least five years of relevant experience in software development, application or product security, DevSecOps, ethical hacking, or a similar hands-on role;
- experience reading and assessing modern application code, for example in .NET/C#, Java, JavaScript/TypeScript, or Python;
- solid knowledge of web and API security, including OWASP Top 10, OWASP ASVS, CWE, and common vulnerability patterns;
- knowledge of authentication and authorization, for example OAuth 2.0, OIDC, SAML, JWT, RBAC, and least privilege;
- practical experience with security testing and assessing findings, both manually and with tooling;
- experience integrating or improving security controls in development and CI/CD processes;
- the ability to clearly explain technical risks to developers, architects, product owners, and management;
- a curious, critical, and pragmatic attitude: you want to test, understand, and improve things yourself.
Experience with cloud-native security in Azure, AWS, or GCP, threat modeling, offensive testing, detection engineering, or AI security is a plus. A relevant certification, such as OSWE, Burp Suite Certified Practitioner, CSSLP, or AZ-500, can also be a plus. Demonstrable practical experience weighs more heavily than certificates. If you don't meet every single point but recognize yourself in the core of the role, we still encourage you to apply.
What the organization offers.
- a key role with direct influence on the security of products used daily by thousands of entrepreneurs;
- room and mandate to further shape application security and secure software development;
- close collaboration with development, architecture, cloud, SRE, AI Foundry, privacy, compliance, and the external SOC;
- a salary of €80,000 to €110,000 gross per year based on 40 hours, depending on experience;
- a position of 32 to 40 hours per week;
- hybrid working: on average 60% at the Amersfoort and/or Alkmaar locations and 40% from home;
- 30 vacation days based on 40 hours;
- a well-arranged pension and monthly payout of vacation pay;
- training opportunities and budget for relevant certifications;
- a laptop and a good workplace, including a sit-stand desk and an ergonomic office chair;
- 220 colleagues who work together to build reliable software for entrepreneurs.
A screening and assessment are part of the recruitment and selection process.
Apply now.
Your details go straight into our system — no middlemen, no mailing lists.