Application Security Engineer

Location: Amsterdam, Netherlands; hybrid working with flexible arrangements. Up to 20 days per year may be worked from abroad in the home country. The role does not come with relocation assistance.

Company

hirify.global operates a global travel platform that helps people experience the world through technology, products, partners, and data.

What you will do

• Build, operate, and improve WAF protections for internet-facing applications and APIs, including managed rules, custom rules, rate limits, exceptions, monitoring, and rollback plans.
• Assess application-layer threats, tune edge controls, reduce false positives, and work with service owners to validate security changes.
• Use WAF, SIEM, application, and cloud telemetry to improve detection logic, queries, alert context, and investigation playbooks.
• Provide third-line technical escalation for application security incidents, including triage, scoping, evidence preservation, containment coordination, and mitigation.
• Document incident findings, improve policies, detections, logging, runbooks, and automation, and track assigned actions to completion.
• Automate security operations and collaborate with application, platform, security operations, and incident response partners while supporting junior colleagues.

Requirements

• Approximately 3–5 years of hands-on experience in security engineering, application security, cloud security, detection and response, or a closely related role, plus a relevant bachelor’s degree or equivalent practical experience.
• Practical experience designing, operating, or tuning web application firewall controls; AWS WAF experience is strongly preferred.
• Experience managing security configuration through code and delivery pipelines, with a working understanding of infrastructure as code and safe change practices.
• Ability to investigate web and API activity with SIEM or log analytics tools, formulate queries, correlate events, assess alert quality, and explain the available evidence.
• Working knowledge of HTTP, web applications, APIs, application-layer attack patterns, and edge-based mitigations.
• Hands-on scripting or programming experience in Python, TypeScript, JavaScript, or a comparable language for security automation or support.
• Experience participating in security incident investigations, including triage, scoping, evidence gathering, containment coordination, and clear documentation.
• Clear communication and sound judgement, with the ability to work independently on common tasks, collaborate on defined work, and seek support for unusual or complex situations.

Nice to have

• Experience with AWS security and logging services, WAF log analysis, or cloud-native application environments.
• Familiarity with SIEM detection engineering, alert tuning, incident playbooks, or security automation.
• Experience handling WAF false positives, application availability concerns, or live security events.
• Knowledge of OWASP web and API risks, bot or automated abuse patterns, and practical edge mitigation.
• Experience using version control and code review for security infrastructure changes.

Culture & Benefits

• Hybrid work with flexible arrangements and up to 20 days per year working abroad from the home country.
• Annual paid time off and paid parent, grandparent, bereavement, and care leave.
• Product discounts of up to 1400 per year, including Genius Level 3 status and hirify.global wallet credit.
• Opportunity to work on a high-scale product used by millions of travelers worldwide and contribute to technical, behavioral, and interpersonal development through projects, hackathons, conferences, and community participation.
• Inclusive workplace with adjustments and tools available for colleagues with disabilities during hiring and employment.

Hiring process

• Applications follow hirify.global’s standard hiring process.
• Successful applicants may undergo third-party pre-employment screening, subject to applicable law.