Senior Application Security Engineer

About the role

We are delivering a Unified Automation Platform (Internal Developer Platform) to standardise delivery, reduce security gaps and enable secure self‑service across Azure and on‑premises VMware. As a Senior Application Security Engineer you will lead critical security‑tooling integrations and policy automation in a governance‑heavy environment.

Key responsibilities

• Implement and operate certificate‑management integration with Venafi, covering issuance, distribution to F5, Azure Key Vault and VM/OS stores, plus renewal automation.
• Build and maintain secrets‑management integration (OpenBao, Azure Key Vault) using configuration‑as‑code for authentication, namespaces, policies and dynamic secret engines.
• Design and run Privileged Access Management “break‑the‑glass” workflows with time‑boxed grants, approval automation, session recording and audit logging.
• Create SIEM and WAF alert‑integration pipelines and a Vulnerability Dashboard that aggregates findings from SAST, DAST, SCA, IAST and ASPM scanners.
• Implement Policy as Code checks (OPA/Conftest, Azure Policy) with a baseline library, CI gate integration and exemption workflow.
• Support Auth/RBAC configuration (Entra ID, Active Directory, GPOs, M365 groups) and translate firewall/WAF requirements (PaloAlto, F5, Cloudflare) into alerting and dashboard views.

Required profile

• 3+ years of hands‑on experience implementing security‑tool integrations such as certificate lifecycle management, secrets management and PAM workflows.
• Proven ability to work within governance‑heavy, security‑sensitive change‑control processes and communicate in English at B2+ level.

Required skills

• Venafi, OpenBao, Azure Key Vault
• Privileged Access Management (PAM) workflows
• SIEM, SOAR, WAF (PaloAlto, F5, Cloudflare)
• SAST, DAST, SCA, IAST, ASPM scanners
• Policy as Code tools: OPA, Conftest, Azure Policy
• Identity & Access Management: Entra ID, Active Directory, RBAC
• Infrastructure as Code: Terraform, OpenTofu
• Microsoft Graph API, Conditional Access automation
• Backstage (or comparable) developer portal integration (nice‑to‑have)
• Supply‑chain security tools: cosign, Sigstore (nice‑to‑have)

What we offer

• Remote‑first work model with the option to use offices in Astana, Almaty or Karaganda.
• Opportunities to work abroad for up to two months per year.
• Leadership development, career advising, soft‑skill and well‑being programs.
• Certification support for GCP, Azure and AWS.
• Employee Stock Purchase Plan, referral bonuses and a comprehensive benefits package.
• Housing support through preferential mortgage access.