Application Security Engineer

Our requirements

• Typically 5+ years of relevant hands-on experience in software engineering, application security engineering, DevSecOps, security automation or a closely related discipline.
• Strong software engineering fundamentals and hands-on experience developing automation, integrations, scripts or security tooling using Python, PowerShell, JavaScript/TypeScript, Go or similar languages.
• Hands-on experience integrating security capabilities into CI/CD and software delivery pipelines, such as GitHub Actions, Azure DevOps, GitLab CI, Jenkins or equivalent platforms.
• Practical experience integrating and operating SAST, SCA, DAST, API security, container security and IaC security capabilities.
• Strong source-code review skills, with the ability to distinguish exploitable security defects from scanner noise and explain practical remediation to software engineers.
• Experience working directly with software engineering, DevOps, platform and architecture teams to embed security controls into development workflows.
• Experience using APIs and structured data to automate security workflows, including ingestion, normalization, deduplication, routing and lifecycle management of findings.
• Strong understanding of secure software design, common application and infrastructure vulnerability classes, attack paths and risk-based remediation.
• Working knowledge of penetration-testing techniques sufficient to reproduce vulnerabilities, validate selected findings and establish realistic exploitability.
• Ability to build reusable security controls, templates and self-service capabilities rather than relying primarily on manual security review.
• Strong written and verbal English communication, disciplined technical documentation and the ability to work effectively with technical and non-technical stakeholders in a global environment.

Optional

• Experience securing AI-integrated application features (prompt injection, agentic abuse, model manipulation) and familiarity with OWASP LLM Top 10, MITRE ATLAS or NIST AI RMF.
• Experience using AI/LLM tooling to accelerate code review, triage and remediation guidance at scale.
• Experience with ASPM platforms and risk-based vulnerability prioritization.
• Experience in financial services or another regulated environment.
• Relevant application security, cloud or engineering certifications are beneficial; demonstrated software engineering, automation and security integration experience matters more than certification count.

Your responsibilities

• EU Regulatory Contex
• Design, execute and document security activities in alignment with applicable European Union and Polish legal, regulatory, privacy and operational-resilience requirements, including GDPR, NIS2 and DORA where relevant to the business and service scope.
• Maintain evidence that is clear, reproducible and audit-ready, while applying data minimization, appropriate access controls and defined retention practices.
• Coordinate cross-border work so that testing authorization, handling of personal data, evidence storage and disclosure of findings remain consistent with EU requirements and internal governance.
• Security Automation and Integration
• Design, implement and maintain automated security checks across source, build, test and delivery workflows using reusable, vendor-portable components.
• Integrate static analysis (Semgrep), software composition analysis, dynamic application security testing, API security testing, Infrastructure-as-Code review and container assessment into engineering pipelines (GitHub Actions, Azure DevOps, or equivalent).
• Apply AI-assisted security review to support triage, code review, finding correlation, remediation guidance and risk summaries, while keeping outputs explainable, auditable and subject to human validation.
• Create secure-by-default templates, reusable controls and self-service capabilities that reduce manual effort and make the preferred secure path the easiest path.
• Continuously tune rules, thresholds and workflows to reduce noise, improve signal quality and prevent duplicate findings.
• Securing AI-Integrated Applications
• Assess AI-integrated application features for prompt injection, insecure output handling, excessive agency, training data leakage and model manipulation, consistent with the OWASP LLM Top 10.
• Review agentic and LLM-backed integrations for authorization boundaries, tool and API exposure, and token scoping.
• Apply enterprise secure-by-default patterns for AI workloads during design and code review, and feed recurring weaknesses back into standards.
• Stay current on the AI threat landscape and translate emerging risks into practical testing and control requirements.
• Finding Management and Remediation Enablement
• Feed normalized, enriched and deduplicated findings into the enterprise ASPM platform so that application risk is prioritized in a single consolidated view rather than per-tool or per-region.
• Maintain regional reporting that shows coverage, exposure, remediation progress, aging and recurring weakness patterns, consistent with enterprise ASPM definitions and severity models.
• Partner with engineering teams to reproduce and validate findings, provide practical remediation guidance and confirm effective closure.
• Escalate material or systemic risks through the enterprise risk governance process, supporting exception and risk-acceptance decisions with complete, traceable evidence.
• Use practical exploitation techniques to validate selected findings and establish realistic exploitability, coordinating with the offensive security team for full-scope testing.
• Program and Process Development
• Help build a maturing application security process, including standards, operating procedures, service definitions, intake paths, exception handling, documentation and supporting tools, aligned to the enterprise AppSec program.
• Work with development, platform, architecture, offensive security, security operations, privacy, risk and compliance teams across countries and cultures.
• Define and improve measures for scanning coverage, actionable signal, remediation flow, repeat weaknesses and automation effectiveness.
• Identify manual bottlenecks and automate high-volume activities so the team can increase coverage and risk reduction without proportional effort.

What we offer

• Permanent employment contract.
• Private healthcare package with Luxmed
• Life insurance with Unum
• MyBenefit cafeteria platform
• Real career growth and learning opportunities within a global organization

Recruitment for