Senior Application Security Engineer

As we keep on growing (+500 people joined Pennylane in 2025!), we're seeking an Application Security Engineer to join Louis's team of 5. You'll handle all technical security matters, support ISO 27001 compliance, and advise employees—especially developers—on security best practices. The technical security team manages security issues from detection to resolution, collaborating with developers and Security Champions when needed.

Responsibilities

Integrate security into features from design to delivery; Ensure the security of the main Web application written in Ruby on Rails and ReactJS (dependencies, code, infrastructure, configuration); Conduct code reviews from a secure development point of view; Detect vulnerabilities and propose associated patches; Raise the security level of CI/CD configuration; Secure AWS infrastructure with the DevOps team, including Kubernetes environment (AWS EKS); Conduct and perform regular security assessments on applications and infrastructure (code reviews/pentests/bug bounty); Strengthen the current means of detecting malicious attempts; Be involved in all security incidents, investigate logs, block attacks, and propose corrective measures; Ensure compliance with ISO 27001 controls related to development; Build/improve secure development training materials and conduct regular training sessions with developers; Engage developers in the Security Champions program; Improve security awareness across the company; Contribute to tenders to explain security policies and technical details

Requirements

To speak English; To be energized by an ever-shifting work environment; To be highly collaborative (within your team or other stakeholders); Sufficiently experienced to prioritize business-led actions; Humble; A team player who is comfortable working with remote colleagues; Proactive and organized; A quick learner who likes to work on different projects (application security, cloud infrastructure, training, ISO 27001)

Nice to have

Ability to perform offensive security assessments on an infrastructure and an application; Ability to exploit and fix a wide range of Web vulnerabilities and explain them to non-technical people; Experience in a programming language (Ruby, Python, JavaScript); Experience in cloud infrastructure security; Ability to popularize technical terms to facilitate adoption of security measures; Fluency in French and/or English (both oral and written)

Benefits

25 vacation days paid by Pennylane; Competitive compensation package; Company shares; Budget to turn home into a more comfortable workspace; Monthly allowance to work from a coworking space; Access to 8000 fitness spaces in Europe and 300+ wellness activities via Gymlib; Latest Apple equipment; Remote work from country of residence in Europe within 2 hours of CET time zone; Company events such as Tech Days every 3 months and annual company seminar; If based in France: French contract following French regulation, 6 to 12 RTT, 5 weeks PTOs, lunch credits (Swile), Alan Blue healthcare cover, regular events in cities like Lyon, Bordeaux, Nantes