Senior Application Security Engineer (Bulgaria)

We are seeking an experienced Senior Application Security Engineer to ensure application security across Platforms and Agile Release Trains (ARTs).

The role combines hands-on application security, secure software development, cloud security, and technical leadership. You will work closely with Cybersecurity, Product, Platform, Infrastructure, and Engineering teams to embed secure-by-design practices throughout the SDLC.

Key Responsibilities

• Drive and support the application security strategy across multiple teams and platforms.
• Lead security initiatives throughout the Software Development Lifecycle (SDLC).
• Conduct security requirements analysis and threat modeling during early design phases.
• Lead security architecture, design, and code reviews.
• Perform hands-on application security testing, identify vulnerabilities, assess their risk, and drive remediation.
• Integrate and improve automated security controls within CI/CD pipelines.
• Drive software supply chain security to protect code, builds, dependencies, and artifacts from tampering.
• Partner with Product Management, Platform Engineering, Development, Infrastructure, and Cyber Defense teams.
• Provide pragmatic, risk-based security recommendations that balance security and business needs.
• Turn lessons learned into reusable security standards, practices, and organizational assets.
• Mentor engineers and promote secure-by-default development practices.
• Coordinate cross-functional security initiatives and drive measurable improvements.

Key Requirements 

• 5+ years of cybersecurity experience, including strong enterprise Application Security expertise.
• 2+ years of hands-on software development experience (.NET/C#, JavaScript, Python preferred).
• Strong knowledge of Secure SDLC, OWASP Top 10, SAMM, ASVS/MASVS and application security best practices.
• Hands-on experience with threat modeling, secure code reviews, security architecture reviews, penetration testing and vulnerability remediation.
• Experience with Burp Suite, OWASP ZAP or similar application security testing tools.
• Strong DevSecOps experience integrating SAST, DAST, SCA, secrets scanning and container scanning into CI/CD pipelines.
• Understanding of software supply chain security and secure development practices.
• Hands-on experience with Microsoft Azure, Kubernetes, containers, IAM and cloud security.
• Knowledge of TCP/IP, TLS/HTTPS, OAuth 2.0, OpenID Connect and web application security.
• Relevant cybersecurity certification (CISSP, CEH, Azure Security or similar); AppSec certification preferred.
• Strong technical leadership, stakeholder communication, mentoring and problem-solving skills.
• Bachelor's degree in Computer Science, Cybersecurity or a related field, or equivalent experience.
• Strong English communication skills.

Ideal Candidate Profile

The strongest candidate is not purely a Cybersecurity/Infrastructure Security specialist. We are looking for someone with a strong Application Security + Software Development + DevSecOps combination.

They should be able to work directly with developers, understand and review code, conduct threat modeling and hands-on application testing, and integrate security tooling into CI/CD pipelines. Experience with Azure, Kubernetes, containers, OWASP practices, Burp Suite/ZAP, and SAST/DAST/SCA is particularly important.

Budget & Benefits

• Annual salary: €47,000 gross (12 salaries per year)
• Annual performance bonus: 15%
• Insurance: Medical and life insurance
• Food vouchers: 200 BGN/month
• Christmas bonus: 100 BGN
• Easter bonus: 200 BGN
• Work model: Hybrid – 3 days onsite in Sofia and 2 days remote per week

About Coca-Cola HBC

Coca-Cola Hellenic is a growth-focused consumer goods business and strategic bottling partner of The Coca-Cola Company, operating across 29 markets in Europe, Africa, and Eurasia.

The organization brings together more than 30,000 people from over 70 nationalities and promotes an inclusive working environment with equal opportunities and a strong focus on employee development, collaboration, and diversity.