Application Security Architect + AI (basic)

Brak informacji o wynagrodzeniu

SeniorHybryda·KrakówFull-time

#474413·Dodano dziś·0

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Application SecuritySecure SDLCthreat modelingAPI securityAuthenticationDevSecOps

Podsumowanie oferty

Design and improve application security architectures and controls for enterprise applications, APIs, microservices, and cloud-native applications. Support secure development and DevSecOps, and use AI-assisted tools for security analysis, testing, and automation.

Wymagania

Bachelor's degree in Computer Science, Cybersecurity, Engineering, or equivalent practical experience.
More than five years of information security experience focused on application security architecture, secure application design, or application security engineering.
Experience delivering or significantly contributing to application security architecture, secure development, DevSecOps integration, or application security improvement projects.
Hands-on application security expertise, including identifying vulnerabilities, assessing security risks, and recommending technical security controls.
Understanding of application security principles, OWASP Top 10, secure coding practices, API security, authentication, authorization, and common vulnerability mitigation techniques.
Practical experience with application security architecture reviews, threat modeling, secure design assessments, or security risk analysis.
Experience with application security tools and technologies such as SAST, DAST, SCA, secrets scanning, or similar security testing solutions.
Good understanding of Secure SDLC, DevSecOps, CI/CD security, and secure-by-design principles.
Working knowledge of at least one programming language, such as Python, Java, C#, JavaScript, TypeScript, or Go, sufficient to review code and assess application security risks.
Working knowledge of related security domains, including cloud security, IAM, network security, data protection, and security operations.
Understanding of security architecture principles and frameworks such as Zero Trust, NIST, ISO 27001, or OWASP guidelines.
Familiarity with application security automation, scripting, and security tooling integration.
Intermediate practical experience with AI-assisted tools and automation, including AI tools for vulnerability analysis, threat modeling, and security research; structured prompting; generating and validating scripts, queries, secure code recommendations, and security documentation; simplifying repetitive workflows; or configuring AI-assisted workflows or integrations.
Understanding of safe AI usage, including data protection, access control, and validation of AI-generated outputs; willingness to further develop AI automation skills.
Strong communication and collaboration skills.
Hands-on technical proficiency.

Nice to have:

Experience with application security platforms such as Snyk, Checkmarx, Veracode, SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, or OWASP ZAP.
Experience with application security architecture for cloud-native applications, microservices, containers, and Kubernetes environments.
Experience with threat modeling methodologies and tools such as STRIDE, OWASP Threat Dragon, or Microsoft Threat Modeling Tool.
Experience with DevSecOps, CI/CD security automation, Infrastructure as Code scanning, and policy-as-code solutions.
Experience with software supply chain security, SBOM, dependency management, and third-party component security.
Experience with API security, OAuth 2.0, OpenID Connect, secrets management, and secure application authentication patterns.
Experience integrating application security findings with SIEM/SOAR, ticketing, or vulnerability management platforms.
Experience with AI automation, AI agents, Microsoft Copilot Studio, Azure OpenAI, Amazon Bedrock, LangChain, Power Automate, or similar tools.
Understanding of AI application security risks, including prompt injection, data leakage, insecure output handling, and excessive AI agent permissions; familiarity with OWASP Top 10 for LLM Applications or similar AI security guidelines.
Security certifications such as CSSLP, CISSP, CISM, CCSP, GWAPT, GWEB, OSCP, OSWE, or similar; AI-related certifications such as AI-900 or AWS Certified AI Practitioner.

Obowiązki

Design and implement security architectures and controls for enterprise applications, APIs, microservices, and cloud-native applications; gather business, technical, and compliance requirements for new implementations, migrations, and security improvements.
Define and improve application security capabilities, including authentication, authorization, API security, encryption, secrets management, and secure configuration; conduct architecture reviews, threat modeling, secure design assessments, and application security risk analysis.
Develop application security reference architectures, security standards, secure design patterns, and secure development guidelines.
Support the Secure Software Development Lifecycle (SSDLC), secure-by-design principles, and DevSecOps integration across engineering teams.
Evaluate and improve application security technologies and processes, including SAST, DAST, SCA, secrets scanning, and vulnerability management; review vulnerabilities, identify architectural weaknesses, and recommend remediation strategies.
Collaborate with development, DevOps, cloud, infrastructure, IAM, security operations, and compliance teams to integrate security into application design and development.
Support security automation and application security tooling integration within CI/CD pipelines and development workflows.
Use AI-assisted tools and workflows for threat modeling, security architecture analysis, vulnerability assessment and remediation recommendations, secure code review, security testing, requirements and compliance analysis, scripting, reporting, documentation, and workflow automation.
Identify opportunities for AI-assisted application security automation while ensuring appropriate validation, data protection, and human oversight.
Communicate application security risks, architectural decisions, and remediation plans to stakeholders and security leadership.

Benefity

Career development programs.
Thought leadership, mentoring, soft skills, and well-being programs.
Certifications in Anthropic, Gemini, GCP, Azure, and AWS.
English classes.
Employee Stock Purchase Plan with a 15% discount.
Benefits package including health insurance, multisport, and shopping vouchers.
Referral bonuses up to $2,000.
Offices with entertainment and relaxation zones, table tennis, and football.
Free snacks and coffee.
Corporate, social, and well-being events.

Pakiet relokacyjny

Kursy językowe

Udziały pracownicze

Ubezpieczenie

Karta sportowa

Premie

Darmowe przekąski

Napoje w biurze

Spotkania integracyjne

Inne informacje

Remote work is available within Poland; the work mode is hybrid by design.
Opportunity to work abroad for up to 60 days annually.
Business-driven relocation opportunities.

EPAM Systems

1668 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz