Senior Application Security Engineer

18.9k - 23.7k PLN18 900 - 23 700 PLN/ mies./ mies.B2BB2B (netto)

SeniorHybryda·KrakówInne·B2B

#470447·Dodano 6 dni temu·2

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Application SecuritySecurity metricsVulnerability Managementpenetration testingSASTDASTSCAAWS Securitythreat modelingAI/ML security testing

Podsumowanie oferty

SpotOn’s Information Security team is hiring a Senior Application Security Engineer to own and mature its application security program. The role focuses on security scanning, penetration testing, and measuring and reporting program performance, while advancing AI/ML penetration testing and threat modeling initiatives.

Wymagania

Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
5+ years of experience in application security, secure code review, or a closely related engineering or security discipline.
Availability to work in a hybrid work model.
Demonstrated experience building or owning security metrics and reporting, ideally including communication of program health to non-technical or executive audiences.
Hands-on experience with SAST, DAST, and SCA tooling, and vulnerability management platforms such as DefectDojo.
Demonstrated experience coordinating or directly performing penetration testing, including working with external testing vendors.
Familiarity with container security concepts and admission control, using Wiz or an equivalent.
Working knowledge of AWS security services and cloud-native application architectures.
Ability to work with minimal day-to-day direction and exercise independent judgment within established security practices.
Strong written and verbal communication skills, including the ability to translate technical findings into a business-relevant narrative for leadership.

Nice to have:

Experience presenting security metrics or dashboards to executive stakeholders.
Experience with threat modeling frameworks such as STRIDE or PASTA.
Exposure to AI/ML security testing or red-teaming.
Familiarity with PCI DSS.

Obowiązki

Program Measurement & Executive Reporting (priority focus)

Define and own the metrics framework for the application security program, including how metrics relate to risk reduction.
Establish baselines for each metric to track program trajectory over time.
Build recurring monthly or quarterly reports that translate raw data into a narrative leadership can act on.
Prepare materials for the Head of Security to present to executive leadership.

Vulnerability Management & Tooling

Own and maintain the application security scanning stack: SAST, DAST, dependency (SCA), and secrets detection across the repository portfolio.
Ensure findings from all scanners display accurately in the inventory system for engineering visibility.
Tune scanner configurations to reduce noise and false positives, and keep detection coverage current as new repositories and services onboard.

Code Review & PR Security Gate

Establish and maintain a consistent PR review practice for security-relevant changes.
Track and report adherence to this process as a core program metric.

Penetration Testing

Lead and coordinate application penetration testing engagements with a third-party vendor, from scoping through remediation tracking.
Serve as the primary point of contact for developers with questions about penetration test findings.
Track penetration test outcomes across successive engagements to measure whether earlier findings remain fixed.

Strategic Initiatives

Design and implement new application security initiatives, including AI-specific penetration testing and formal threat modeling practices.
Define success metrics for each new initiative before launch.

Container & Supply Chain Security

Implement and maintain image trust enforcement.
Partner with Infrastructure and DevOps to ensure image signing and trust policies do not create unnecessary friction in the deployment pipeline.

Benefity

Annual training budget of 3,500 PLN gross.
Access to e-learning platforms, including O’Reilly.
Fully paid private healthcare through LuxMed.
Access to the Worksmile platform with a monthly top-up.
Subsidized breakfast and lunch through the vending machine in the Kraków office; lunches in the Gdańsk office once a week.
Group English classes with a native speaker.
A new MacBook Pro, 4K monitors, or other tools needed for the role.
Flexible working hours.
Access to the company library.
Chill-out room with a PlayStation and games.
Free snacks and beverages in the kitchen.
Company parties and social activities.
Employee referral program.
Relocation package within Poland.

Dofinansowanie szkoleń

Opieka zdrowotna

Kursy językowe

Elastyczne godziny

Pakiet relokacyjny

Chill room

Darmowe przekąski

Napoje w biurze

Spotkania integracyjne

Inne informacje

Relocation support is available within Poland.

SpotOn

2 aktywne oferty

Zobacz wszystkie oferty

Aplikuj teraz