Application Security Engineer

SonarSource is hiring for an Application Security Engineer to help protect the next generation of AI-powered software. The role is onsite in Geneva, with the chance to shape security for products that are already trusted by many of the world's largest enterprises. If you enjoy blending hands-on security work with design reviews and you want to influence how modern cloud systems stay secure, this is a strong fit. SonarSource is a leader in AI code review and verification, with products that support AI-assisted development and governance across the software supply chain. They work with big names and help customers build reliable, compliant software while reducing outages caused by AI-generated code.

You'll join a security organization dedicated to earning deep trust from customers by safeguarding Sonar products and their cloud platforms to high security standards. The team collaborates with product, platform, and infrastructure engineers so security is integrated from the earliest design stages through to deployment and operation. The Geneva-based role sits in a company that spans several global hubs and operates under a CODE mindset: commitment to customers, a focus on quality, deliberate decisions, and teamwork.

SonarSource describes its mission as building the backbone of the AI software revolution, with a track record of solid growth and a culture that values impact and speed. The role is based in Geneva, Switzerland, and relocation can be considered for the right candidate.

Shaping secure products and cloud architecture

In this role you’ll work with product and engineering teams from the earliest design phases to embed security into resilient, scalable solutions. You’ll review architectures and AWS environments to ensure security requirements guide technical decisions and final designs. You’ll bring a security-by-design perspective to product roadmaps and cloud patterns, helping the team balance innovation with robust protections.

Beyond design, you’ll lead security assurance initiatives, moving from strategic plans to hands-on deployment of modern security tools and capabilities across the organization. You’ll plan independent security assessments, coordinate red-team and penetration tests, and translate findings into practical improvements and customer-facing trust artifacts. When issues surface, you’ll investigate root causes and help teams implement durable remediation that reduces risk over time.

On the incident side, you’ll guide investigations into customer security concerns with a calm, thorough approach, using each engagement to strengthen confidence in Sonar’s security program. You may participate on-call occasionally, serving as a security expert during incidents to help teams understand, contain, and learn from emerging threats. You’ll also keep an eye on the threat landscape, translating intelligence into prioritized risks and actionable steps for the team. Automating security processes to improve speed, clarity, and impact is a natural part of the job as the program scales.

What you’ll bring to the role

Must-haves

• Extensive background in building and securing applications and cloud environments, with a focus on AWS and a strong curiosity about how cloud patterns influence security outcomes
• Proven experience conducting application security assessments, including code reviews and evaluating how authentication and authorization are designed
• Experience evaluating AI and agentic AI capabilities for security, plus a willingness to experiment and help set new best practices
• Familiarity with threat modeling approaches like STRIDE to surface risks early in design discussions
• Hands-on experience with penetration testing, red-team exercises, and bug-bounty programs, applying an attacker’s mindset to protect the most important assets
• Ability to triage and manage vulnerabilities through remediation while capturing organizational learning
• Practical use of AI to automate repetitive security work and a habit for building small tools that speed up security teams
• Comfort with Azure, GCP, and Google Workspace is a plus, plus a willingness to learn new platforms as Sonar evolves

Nice-to-haves

• Experience working in environments that combine cloud security and software verification for AI-enabled products
• Exposure to incident response processes in customer-facing scenarios and the ability to communicate security concepts clearly to non-technical stakeholders

Practical details and what to expect in Geneva

This position is based in Geneva, Switzerland and requires onsite presence. The company is open to relocating the right candidate. On occasion, there may be on-call work to support incident handling. The role is subject to a comprehensive background check and reference verification before start. Applications submitted through agencies or third-party recruiters are not considered. The team emphasizes inclusion and encourages applicants from diverse backgrounds.

Tips to stand out for this security role

First, tailor your resume to showcase concrete AWS architecture work and specific secure-by-design projects. Mention how you’ve shaped architectures to meet security requirements early in the design process and any measurable outcomes you achieved.

Second, provide solid evidence of the must-have skills: cite a threat-modeling exercise you led (preferably using STRIDE), a documented security assessment or code review you performed, and any AI/agentic security work you’ve done, including practical remediation steps and resulting risk reductions.

Third, prepare stories for interviews that demonstrate how you handled an incident or vulnerability from discovery to remediation, including how you communicated with customers and influenced improvements in the security program. Be ready to discuss how you stay ahead of threats and how you would automate security tasks in a growing organization.

Fourth, consider a thoughtful question to end with, such as: how does Sonar measure the effectiveness of its security program across AI-driven features and cloud platforms, and what are current priorities for threat intel integration and automation?