Application Security & Vulnerability Validation Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnieFull-time

#477895·Dodano 4 dni temu·6

Źródło: EPAM Systems

Aplikuj teraz

Tech Stack / Keywords

C++Go Java PythonCWECVEOWASP Top 10STRIDEPASTASAST

Podsumowanie oferty

Serve as the operational and technical bridge between automated/AI-driven security scanning and remediation systems and product engineering teams. Validate vulnerabilities and security patches, and help drive confirmed issues through to verified production closure.

Wymagania

5+ years of hands-on experience in Application Security, Product Security, or Software Engineering, focused on vulnerability validation, secure code review, and test automation.
Proficiency reading, writing, and debugging code in at least two of C++, Go, Java, or Python, including setting up local test harnesses, mocking dependencies, and building minimal PoCs.
Deep understanding of secure coding standards, including input validation, boundary checking, safe memory access, and concurrency safety.
Working knowledge of vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflows.
Understanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks such as STRIDE and PASTA.
Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate with software engineering owners through code review.

Nice to have:

Experience validating, debugging, or prompt-tuning automated code generation tools, along with automated patch validation and differential testing.
Practical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across services.

Obowiązki

Construct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findings.
Distinguish exploitable vulnerabilities from scanner false positives and attach reproducible evidence to issue tickets.
Supervise, review, and validate code patches generated by automated and AI/agentic remediation systems before routing them to product code owners.
Inspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and unintended functional regressions.
Execute unit, integration, and differential tests to confirm fix efficacy and build stability.
Review, filter, and prioritize findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24–48 hour turnaround window.
Classify vulnerability severity using standardized scoring rubrics and map valid findings to remediation SLAs.
Evaluate compliance exception requests against security policies and escalate ambiguous, disputed, or architectural edge cases to senior security leads.
Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services.
Maintain standardized threat models and service risk classification tags in centralized repositories.
Route verified, test-passing security patches (changelists/pull requests) to product engineering owners.
Shepherd fixes through code review, track remediation SLAs, and verify end-to-end deployment to production.

Benefity

Career development programs, mentoring, and soft-skills and well-being programs.
Certifications, including Anthropic, Gemini, GCP, Azure, and AWS.
English classes.
Employee Stock Purchase Plan participation with a 15% discount.
Health insurance, multisport, and shopping vouchers.
Referral bonuses up to $2,000.
Offices with entertainment and relaxation zones, table tennis, football, free snacks, and coffee.
Corporate, social, and well-being events.
Business-driven relocation opportunities.

Kursy językowe

Udziały pracownicze

Ubezpieczenie

Karta sportowa

Premie

Darmowe przekąski

Napoje w biurze

Spotkania integracyjne

Inne informacje

Remote work is available within Poland; employees may work abroad for up to 60 days annually.

EPAM Systems

1770 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz