Application Security Specialist

Our requirements

• Degree in Computer Science, Information Security, Cybersecurity or a related field, or equivalent practical experience
• 4–5 years of experience in application security, software security, secure software development or a closely related field
• Hands-on experience with application security assessments, vulnerability analysis or security testing
• Experience working with development teams to identify and fix security issues
• Intermediate programming or scripting skills in Python, Java or .NET, with experience building digital products
• Experience with AppSec tools such as Semgrep, SonarQube, HCL AppScan, ZAP, Black Duck or Sonatype Lifecycle (or comparable)
• Good understanding of OWASP Top 10, OWASP ASVS and other relevant OWASP standards
• Familiarity with SAST, DAST and SCA and their integration into CI/CD pipelines
• Experience with cloud-native application security, containers or Kubernetes
• Familiarity with DevSecOps practices, version control and CI/CD, preferably Jenkins, Git, Docker or Kubernetes
• Understanding of vulnerability management, risk assessment and remediation processes
• Strong analytical skills, attention to detail and the ability to explain technical findings to different audiences
• Collaborative, proactive mindset with a sense of ownership
• Fluent English

Optional

• Experience with threat modelling and security design reviews
• Familiarity with NIST, OWASP DSOMM and OWASP SAMM
• Application security or cybersecurity certifications
• Awareness of emerging regulations such as the EU Cyber Resilience Act (CRA)

Your responsibilities

• Support development teams in integrating security into the SDLC and applying secure coding practices
• Perform and support security assessments using AppSec tools, analyse findings, prioritise risks and guide teams through vulnerability remediation
• Work with SAST, DAST, SCA and other security testing technologies to identify risks in applications
• Contribute to threat modelling, security design reviews and the use of established security patterns
• Support integration and improvement of AppSec tools and processes within CI/CD pipelines and development workflows
• Contribute to security awareness activities, training materials and guidance for development teams
• Help teams implement security requirements, standards and internal policies
• Identify opportunities to improve AppSec processes, tooling and ways of working
• Communicate findings, explain risks and support practical remediation with developers, architects and security colleagues

About the project

This is how we organize our work

This is how we work on a project

• Continuous Deployment
• Continuous Integration
• documentation
• issue tracking tools

Development opportunities we offer

• external training
• mentoring

OPTIVEUM SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ