Application Security & Vulnerability Validation Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnie·GdańskFull-time

#478038·Dodano 4 dni temu·0

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Application Securityvulnerability validationSecure Code Reviewthreat modelingSASTDASTProof of Concept DevelopmentPatch ValidationC++Go

Podsumowanie oferty

Serve as the operational and technical bridge between automated and AI-driven security scanning and remediation systems and product engineering teams. Validate vulnerabilities and security patches, and help drive confirmed issues to verified production closure.

Wymagania

5+ years of hands-on experience in Application Security, Product Security, or Software Engineering, with a strong focus on vulnerability validation, secure code review, and test automation.
Proficiency in reading, writing, and debugging code in at least two core languages (C++, Go, Java, or Python), including setting up local test harnesses, mocking dependencies, and building minimal PoCs.
Deep understanding of secure coding standards, including input validation, boundary checking, safe memory access, and concurrency safety; attention to detail when reviewing code diffs for regressions, hallucinations, or off-by-one errors.
Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflows.
Understanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks such as STRIDE and PASTA.
Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate with software engineering owners through code review.

Nice to have:

Experience validating, debugging, or prompt-tuning automated code generation tools, along with automated patch validation and differential testing.
Practical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across services.

Obowiązki

Construct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findings.
Distinguish true, exploitable vulnerabilities from scanner false positives and attach clear, reproducible evidence to issue tickets.
Supervise, review, and validate code patches generated by automated and AI-agentic remediation systems before routing them to product code owners.
Inspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and unintended functional regressions.
Execute unit, integration, and differential tests to confirm fix efficacy and build stability, targeting a ≥90% patch acceptance rate by code owners without major revision.
Review, filter, and prioritize findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24–48 hour turnaround window.
Classify vulnerability severity using standardized scoring rubrics and map valid findings to strict remediation SLAs.
Evaluate standard compliance exception requests against established security policies and escalate ambiguous, disputed, or architectural edge cases to senior security leads.
Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services.
Maintain standardized threat models and service risk classification tags in centralized repositories.
Route verified, test-passing security patches (changelists / pull requests) to designated product engineering owners.
Shepherd fixes through code review, track remediation SLAs, and verify end-to-end deployment to production.

Benefity

Career development programs.
Thought leadership, mentoring, soft skills, and well-being programs.
Certification in Anthropic, Gemini, GCP, Azure, and AWS.
English classes.
Participation in the Employee Stock Purchase Plan with a 15% discount.
Benefits package including health insurance, multisport, and shopping vouchers.
Referral bonuses up to $2,000.
Business-driven relocation opportunities.
Offices with entertainment and relaxation zones, table tennis and football, free snacks, and coffee.
Corporate, social, and well-being events.

Kursy językowe

Udziały pracownicze

Ubezpieczenie

Karta sportowa

Premie

Darmowe przekąski

Napoje w biurze

Spotkania integracyjne

Inne informacje

Remote work is available within Poland.
Opportunity to work abroad for up to 60 days annually.

EPAM Systems

1770 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz