Senior Application Security Engineer (Secure-by-Design, Threat Modelling) for NATO with security clearance

Senior Application Security Engineer (Secure-by-Design, Threat Modelling) for NATO with security clearance Senior engineering where application support and security architecture meet — threat modelling, hardening baselines and identity, on a hybrid pattern near Brussels. Two jobs that are usually done by two people, done properly by one: keeping a portfolio of commercial applications running, and being the person who decides whether their design is safe. It is a senior post, and the security half is not decoration — you would own reference architectures, hardening baselines and the technical risk register entries that go with them. It suits an engineer who is credible in an architecture review and still willing to open a ticket queue afterwards. What you would be doing Define secure-by-design reference architectures, patterns and hardening baselines, and review new or changed service designs against them. Lead threat modelling for new and materially changed services, own the technical risk entries, and track mitigations to closure. Run proofs of concept and produce evidence-based recommendations covering cost, operational impact, lock-in and exit. Support deployment and operation of server applications on Windows and Linux, and integrate them with identity providers. Manage cloud configuration across Azure and AWS, including identity groups and roles. Support deployment, configuration and monitoring of AI-based tooling and its integration with existing applications. Handle complex third-line incidents, escalate to vendors where it is warranted, and build the knowledge base as you go. What you would bring Senior experience supporting commercial applications in a large, governed environment. Security architecture in practice — threat modelling, hardening, risk registers, architecture gates. Identity and access work: OAuth, OpenID Connect, SAML 2.0, and directory-backed identity in the cloud. Cloud configuration on Azure and AWS. Windows and Linux server application deployment, and administration of collaboration tooling. Strong customer relationship skills — much of the value here is in how the advice lands. The pattern is hybrid, with half the time on site in Braine-l'Alleud. Department Security Locations Braine-l'Alleud Remote status Hybrid Braine-l'Alleud About WLG Work Life Group Sp. z o.o., agencja zatrudnienia (employment agency) KRAZ no. 19578. NIP 7010247728. ul. Nowogrodzka 50/54 lok. 515, 00-695 Warszawa, Poland.