Application Security & Vulnerability Validation Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnie·KatowiceFull-time

#478025·Dodano 4 dni temu·0

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Application Securityvulnerability validationSecure Code Reviewthreat modelingSASTDASTExploit DevelopmentDebuggingC++Fuzz Testing

Podsumowanie oferty

Serve as the operational and technical bridge between automated and AI-driven security scanning and remediation systems and product engineering teams. Validate vulnerabilities and security patches, and work with software engineers to bring confirmed issues to verified production closure.

Wymagania

5+ years of hands-on experience in Application Security, Product Security, or Software Engineering, focused on vulnerability validation, secure code review, and test automation.
Proficiency in reading, writing, and debugging code in at least two of C++, Go, Java, or Python, including setting up local test harnesses, mocking dependencies, and building minimal PoCs.
Deep understanding of secure coding standards, including input validation, boundary checking, safe memory access, and concurrency safety; attention to detail when reviewing code diffs for regressions, hallucinations, or off-by-one errors.
Working knowledge of vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflows.
Understanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks such as STRIDE and PASTA.
Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate with software engineering owners through code review.

Nice to have:

Experience validating, debugging, or prompt-tuning automated code generation tools, as well as automated patch validation and differential testing.
Practical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across services.

Obowiązki

Construct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findings.
Distinguish exploitable vulnerabilities from scanner false positives and attach reproducible evidence to issue tickets.
Review and validate patches generated by automated and AI-driven remediation systems before routing them to product code owners.
Inspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and unintended functional regressions.
Execute unit, integration, and differential tests to confirm fix efficacy and build stability.
Review, filter, and prioritize findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24–48 hour turnaround window.
Classify vulnerability severity using standardized scoring rubrics and map valid findings to remediation SLAs.
Evaluate compliance exception requests against security policies and escalate ambiguous, disputed, or architectural edge cases to senior security leads.
Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services.
Maintain standardized threat models and service risk classification tags in centralized repositories.
Route verified, test-passing security patches to designated product engineering owners.
Shepherd fixes through code review, track remediation SLAs, and verify deployment to production.

Benefity

Career development programs.
Mentoring, soft skills, and well-being programs.
Certification opportunities in Anthropic, Gemini, GCP, Azure, and AWS.
English classes.
Employee Stock Purchase Plan with a 15% discount.
Benefits package including health insurance, multisport, and shopping vouchers.
Referral bonuses up to $2,000.
Offices with entertainment and relaxation zones, table tennis, football, free snacks, and coffee.
Corporate, social, and well-being events.

Pakiet relokacyjny

Kursy językowe

Ubezpieczenie

Karta sportowa

Udziały pracownicze

Premie

Darmowe przekąski

Napoje w biurze

Spotkania integracyjne

Chill room

Inne informacje

Remote work is available within Poland; the work mode is described as hybrid by design.
The opportunity to work abroad for up to 60 days annually.
Benefits listed in the offer are available to employees only; the company is also open to B2B contractors, with terms agreed individually.

EPAM Systems

1770 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz