Application Security Engineer – Secure Design & Threat ModelingADROIT PEOPLE LTD • Leeds, England, United Kingdom
Application Security Engineer – Secure Design & Threat Modeling
ADROIT PEOPLE LTD
- Leeds, England, United Kingdom
- Leeds, England, United Kingdom
Über
What is application security design, and why is it important? Answer:
Application security design focuses on building security into the architecture before code is written. It helps prevent systemic vulnerabilities that cannot be fixed by tools later, such as broken trust boundaries, weak authentication flows, or insecure data handling. Fixing design flaws early is significantly cheaper and reduces long-term risk compared to relying only on SAST/DAST after development.
What is application security design, and why is it important? How do you approach a secure design review? Answer:
I follow a structured approach: Understand business goals and data sensitivity Review architecture diagrams and data flows Identify trust boundaries and entry points Perform threat modeling (STRIDE/OWASP) Validate authentication, authorization, and data protection Recommend design controls and document risks The goal is risk reduction, not perfection. What is threat modeling, and how do you apply it? Answer:
Threat modeling is a structured method to identify how an attacker could abuse a system. I typically use STRIDE for technical threats and PASTA when business impact is important. I Focus On: Entry points (UI, APIs, integrations) Trust boundaries High-impact abuse cases How do you identify trust boundaries in an application? How do you design secure authentication? Answer: OAuth 2.0 + OIDC for modern apps SAML for enterprise SSO Key Design Principles:
Centralized identity provider Short-lived tokens Secure token storage MFA for privileged access OAuth2 vs OIDC vs SAML when do you use each? Answer: OIDC: Modern web/mobile apps (authentication + identity) OAuth2: Authorization between services SAML: Enterprise legacy SSO How do you prevent broken access control at design time? Answer: Server-side authorization checks Centralized authorization logic Default-deny policies Role/attribute validation per request RBAC vs ABAC which do you prefer? Answer: RBAC is simple and works well for stable roles. ABAC scales better for dynamic, data-driven decisions. What are the top API security risks you design for? Answer: Broken Object Level Authorization (BOLA) Broken Function Level Authorization (BFLA) Excessive data exposure Lack of rate limiting Injection via APIs
#J-18808-Ljbffr
Sprachkenntnisse
- English
Hinweis für Nutzer
Dieses Stellenangebot stammt von einer Partnerplattform von TieTalent. Klicken Sie auf „Jetzt Bewerben“, um Ihre Bewerbung direkt auf deren Website einzureichen.