Application Security & VIPR Expert (Armis)

About the role

The Application Security & VIPR expert is a hands-on technical leader who architects, automates and continuously improves Armis' application security posture, making sure application vulnerabilities are fully integrated into Armis' VIPR framework. The role bridges engineering, product security and vulnerability management, defining how application risks are identified, prioritized, contextualized and remediated across Armis' SaaS and on-prem platforms. The position is based in Spain.

Key responsibilities

• Lead the Application Security program across all Armis products, embedding security throughout the SDLC, and run secure design and architecture reviews with engineering teams.
• Conduct threat modeling sessions using STRIDE, DREAD or PASTA.
• Own application-layer vulnerability management from detection through remediation and validation, integrating SAST, DAST, SCA and API test findings into centralized workflows and risk scoring.
• Correlate vulnerabilities with asset context, exploit intelligence and business criticality, and track metrics such as MTTD, MTTR and exposure windows.
• Build and maintain automated AppSec pipelines and integrate security scanning into CI/CD pipelines (GitHub Actions, Jenkins, Buildkite).
• Help secure APIs, microservices and containerized workloads (Docker, Kubernetes) with Cloud and Infrastructure Security.
• Maintain secure coding standards and baselines for React, Node.js, Python, Java and Go, mentor engineers and deliver secure coding and threat modeling workshops.
• Support compliance and audit readiness for SOC 2, ISO 27001, FedRAMP and HIPAA.

Required profile

• 7-10+ years of experience in Application Security, Product Security or Secure Software Engineering.
• Proven expertise in SAST, DAST, SCA and dependency management tools (e.g. Veracode, Checkmarx, Fortify, Snyk, SonarQube, OWASP Dependency-Check).
• Preferred: experience in a SaaS, cloud-native or cybersecurity product company, and hands-on integration of AppSec into VIPR or exposure management programs.
• Ability to communicate technical risk clearly to engineering teams and business stakeholders.

Required skills

• Preferred: cloud and container security platforms (Prisma Cloud, Wiz, Orca), IaC security (Terraform, CloudFormation), API gateway security, OAuth2, token-based auth and zero-trust.
• Certifications such as OSWE, CSSLP, GWAPT, GWEB, CEH.
• Coding in at least two modern languages (Python, JavaScript/TypeScript, Java, Go).
• Threat modeling, secure architecture reviews, microservices and API security.
• CI/CD pipelines, Git workflows and secure build automation.