> Markdown version of [/jobs/ext/2911511-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/2911511-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Application Security Engineer - **Company:** Jll - **Location:** Spain - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Applications Architecture, User Authentication, Microsoft Azure, Cloud Computing, Cyber Security, Continuous Integration, Software Design Patterns, Identity and Access Management, Information Systems Security Architecture Professional, Key Management, OAuth, OpenID, Open Web Application Security, Public Key Infrastructure, Systems Development Life Cycle, Zero Trust Network Access, Secure Coding, Software Engineering, Systems Integration, Google Cloud, Enterprise Software Applications, Large Language Models, Software Security, Containerization, Information Technology, Devsecops, Static Application Security Testing, Microservices, Dynamic Application Security Testing - **Published:** September 15, 2026 - **Apply:** https://www.buscojobs.com.es/application-security-engineer-en-espana-ID-370757145 ## About the Role Required Knowledge, Skills, and Abilities: Technical Knowledge Comprehensive knowledge of application security methodologies, including OWASP Top 10, SANS/CWE, secure development frameworks, and security architecture design patterns. Demonstrated experience designing security architectures for cloud-native environments (AWS, Azure, GCP), microservices, APIs, and containerized workloads. Strong proficiency in DevSecOps practices and tooling: SAST, DAST, SCA, container image scanning, secrets management, and CI/CD security integration. Experience with enterprise security frameworks including NIST CSF, NIST SP ******, ISO *****, and zero-trust architecture principles. Working knowledge of identity and access management (IAM), OAuth 2.0/OIDC, and application-layer authentication and authorization controls. Understanding of cryptography, data protection, encryption, and Public Key Infrastructure Familiarity with threat modeling methodologies (STRIDE, PASTA, or equivalent) and their application to complex distributed application architectures. Knowledge of OWASP: GenAi, LLM Top 10, Security Exchange, Ai Exchange a plus Skills & Abilities Ability to analyze complex application architectures and translate security requirements into practical, implementable design solutions. Strong communication skills with the ability to convey technical security risks and architectural recommendations to diverse stakeholders including development teams, business leaders, and enterprise architects. Demonstrated ability to lead security assessments, architecture reviews, and cross-functional security initiatives independently. Proven capability to mentor and guide junior security professionals and developers on secure design practices and security engineering standards. Analytical and problem-solving skills applied to sophisticated security integration challenges with enterprise-wide implications. Ability to balance security rigor with development velocity, enabling secure delivery of digital applications and services. Education & Experience Bachelor's degree in Computer Science, Information Security, Software Engineering, or a related field; equivalent experience considered. 7+ years of experience in information security with a focus on application security engineering, secure software development, or security architecture. Relevant certifications preferred: CSSLP, CISSP, AWS/Azure Security Specialty, OSCP, or equivalent application security or architecture credentials. #J-*****-Ljbffr ## Description Senior Application Security Architect At JLL, we're reimagining how the world's most complex real estate environments are secured, operated, and experienced.The Application Security Architect is a senior individual contributor responsible for bridging application security engineering and enterprise security architecture at JLL.This role designs and owns security architectures for application ecosystems, integrates security into the software development lifecycle (SDLC), and serves as a technical authority on secure design patterns, threat modeling, and DevSecOps practices.Operating at the Senior level, this position independently leads application security initiatives, mentors junior engineers and developers, and partners across engineering, architecture, and business teams to reduce risk and enable secure digital transformation.If you're a strategic thinker with application security expertise who thrives in a large, dynamic environment and wants their work to have real, visible impact, we want to hear from you.Essential Duties and Responsibilities: Security Architecture & Design Design and maintain security architecture standards, policies, and patterns for enterprise applications, platforms, and cloud-native environments, ensuring alignment with JLL's technology strategy and risk posture.Develop and enforce secure design patterns, reference architectures, and architecture decision records (ADRs) for application security across development teams.Lead security architecture reviews for new and existing applications, evaluating designs against frameworks such as OWASP, NIST, and SANS.Integrate zero-trust principles and defense-in-depth strategies into application architecture to reduce attack surface and support enterprise risk management goals.DevSecOps & Secure Development Lifecycle Define and maintain a standardized set of enterprise application security requirements and produce metrics to report performance against those requirements.Lead threat modeling sessions for new application features and system integrations, producing actionable remediation guidance for development teams.Champion secure coding standards and developer security enablement programs in collaboration with platform and application engineering teams.Risk, Compliance & Stakeholder Engagement Analyze complex security requirements across multiple technology domains and design comprehensive security solutions that address enterprise risk and regulatory compliance obligations.Communicate security architecture designs, risk assessments, and remediation recommendations to technical and non-technical stakeholders across business units.Coordinate security design reviews and approval processes, facilitating alignment between security, engineering, and enterprise architecture teams.Contribute to JLL's application security strategy roadmap, identifying emerging threats and recommending enhancements to the secure development and architecture programs.Mentorship & Team Leadership Provide technical guidance and mentoring to junior security engineers, developers, and architects on application security principles, secure coding practices, and architectural standards.Lead cross-functional security initiatives, driving collaborative approaches to security integration across development and architecture teams.Support secure development training and awareness programs to build security competency across engineering organizations.Required Knowledge, Skills, and Abilities: Technical Knowledge Comprehensive knowledge of application security methodologies, including OWASP Top 10, SANS/CWE, secure development frameworks, and security architecture design patterns.Demonstrated experience designing security architectures for cloud-native environments (AWS, Azure, GCP), microservices, APIs, and containerized workloads.Strong proficiency in DevSecOps practices and tooling: SAST, DAST, SCA, container image scanning, secrets management, and CI/CD security integration.Experience with enterprise security frameworks including NIST CSF, NIST SP ******, ISO *****, and zero-trust architecture principles.Working knowledge of identity and access management (IAM), OAuth 2.0/OIDC, and application-layer authentication and authorization controls.Understanding of cryptography, data protection, encryption, and Public Key Infrastructure Familiarity with threat modeling methodologies (STRIDE, PASTA, or equivalent) and their application to complex distributed application architectures.Knowledge of OWASP: GenAi, LLM Top 10, Security Exchange, Ai Exchange a plus Skills & Abilities Ability to analyze complex application architectures and translate security requirements into practical, implementable design solutions.Strong communication skills with the ability to convey technical security risks and architectural recommendations to diverse stakeholders including development teams, business leaders, and enterprise architects.Demonstrated ability to lead security assessments, architecture reviews, and cross-functional security initiatives independently.Proven capability to mentor and guide junior security professionals and developers on secure design practices and security engineering standards.Analytical and problem-solving skills applied to sophisticated security integration challenges with enterprise-wide implications.Ability to balance security rigor with development velocity, enabling secure delivery of digital applications and services.Education & Experience Bachelor's degree in Computer Science, Information Security, Software Engineering, or a related field; equivalent experience considered.7+ years of experience in information security with a focus on application security engineering, secure software development, or security architecture.Relevant certifications preferred: CSSLP, CISSP, AWS/Azure Security Specialty, OSCP, or equivalent application security or architecture credentials.#J-*****-Ljbffr ## Related Videos - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) ## Related Articles - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)