Finding the best way to place the components of an application on a set of heterogeneous servers is a challenging task, especially if some components are associated with security requirements. To address security requirements, several security controls may be available, some of them software-based (e.g., encryption), others hardware-based (e.g., trusted execution environments). Security controls may incur widely varying performance overhead. There is a non-trivial interplay between application placement (which component to place on which server) and the configuration of security controls (which security control to activate for which component). On the one hand, placing a component on a secure server may make it unnecessary to use software-based security controls for the component. On the other hand, the overhead of using a specific security control may increase the resource requirements of a component so that it does not fit onto its designated server. Therefore, this paper addresses the joint problem of application placement and configuration of security controls. We formalize the problem and use mixed integer quadratic programming to solve it. A case study is used to demonstrate that the proposed approach can automatically determine the placement and configuration of complex applications.