Application Security Domain Expert / Secure Code Review Specialist

Application Security Domain Expert / Secure Code Review Specialist

Location: Amstelveen / Amsterdam, Netherlands

Contract: Until 30 June 2027

Hours: 36 hours per week

Working model: Hybrid

Contract type: Contractor / ZZP possible

Language: English

Start: ASAP

We are looking for an experienced Application Security Domain Expert with a strong hands-on development and secure coding background.

This role sits within an Application Security environment and focuses heavily on reviewing application code, validating security vulnerabilities and helping development teams remediate security risks .

The ideal candidate is not purely a penetration tester. You should be comfortable reading and understanding application code, identifying security weaknesses and discussing practical remediation directly with software engineers.

Key Responsibilities

• Perform detailed secure code reviews across applications and development projects.
• Validate reported security vulnerabilities and determine their actual technical impact.
• Identify insecure coding patterns and recommend practical remediation.
• Carry out application security assessments and provide actionable security recommendations.
• Develop and review threat models for applications, systems and new initiatives.
• Provide Application Security architecture guidance during projects and application reviews.
• Work closely with developers to resolve vulnerabilities effectively and within agreed timelines.
• Help prioritise security findings based on technical severity and business risk.
• Use and support Application Security tooling including:
• SAST – Static Application Security Testing
• DAST – Dynamic Application Security Testing
• SCA – Software Composition Analysis
• Support development teams in adopting secure coding standards and security best practices.
• Translate complex technical security risks into clear recommendations for both technical and non-technical stakeholders.
• Contribute directly to reducing application and enterprise security risk.

Required Experience

• Strong hands-on experience within Application Security / Product Security / Secure Software Development .
• Strong ability to read, review and understand application source code .
• Experience conducting secure code reviews and identifying vulnerabilities within application code.
• Good understanding of common application vulnerabilities and secure coding principles.
• Practical experience with SAST, DAST and SCA tooling .
• Experience conducting security assessments and vulnerability validation.
• Strong knowledge of cybersecurity principles and Application Security architecture.
• Experience with threat modelling and security architecture reviews.
• Understanding of cloud security and modern cloud-based application environments.
• Ability to assess technical security findings and translate them into clear remediation actions.
• Experience working directly with software engineering and development teams.

Preferred Profile

We are particularly interested in candidates who come from a software development or engineering background and have moved into Application Security .

You should be comfortable opening an unfamiliar codebase, understanding how the application works and quickly identifying potential security concerns.

Experience with languages such as Java, JavaScript/TypeScript, Python, C#/.NET or similar enterprise development technologies would be highly relevant.

Personal Skills

• High level of ownership and accountability.
• Able to work independently within complex enterprise environments.
• Strong analytical and problem-solving ability.
• Excellent stakeholder management and advisory skills.
• Comfortable challenging and advising development teams constructively.
• Able to simplify complex security risks into understandable business language.
• Practical and remediation-focused rather than purely theoretical.

This is a strong opportunity for an Application Security specialist who combines secure coding knowledge, hands-on code review capability and security advisory experience within a large enterprise environment.