Application Security Engineer (AppSec)

Conduct application security assessments, source-code reviews, and penetration testing.

Take part in threat modeling and security architecture reviews for new and existing products.

Triage Bug Bounty submissions — validating and reproducing vulnerabilities, assessing severity and business impact, filtering out duplicates and false positives, communicating with researchers, and coordinating fixes with engineering teams.

Identify, prioritize, and track vulnerabilities through to remediation.

Give developers clear guidance on remediation and secure coding practices.

Support the integration and operation of SAST, DAST, SCA, secrets scanning, and other security tools within CI/CD pipelines.

Help define and review security requirements across the software development lifecycle.

Validate findings from security tools and help cut down false positives.

Support investigations and remediation efforts for application-related security incidents.

Contribute to the development of application security standards, guidelines, and reusable security controls.

Help deliver security training and promote secure development practices among engineering teams.

Collaborate closely with developers, DevOps, QA, product teams, and other security specialists.

Keep track of emerging application security threats and help improve AppSec processes.

2+ years of experience in Application Security, Product Security, or a related security role.

Strong knowledge of web application security, the OWASP Top 10, common attack techniques, and secure coding practices.

Hands-on experience with threat modeling, security architecture reviews, vulnerability assessment, and penetration testing.

Ability to review source code and identify security vulnerabilities.

Experience with SAST, DAST, SCA, secrets scanning, and vulnerability-management tools.

Understanding of CI/CD pipelines and experience integrating security checks into the SDLC.

Knowledge of API security, authentication, authorization, and common security protocols.

Familiarity with cloud, container, or Kubernetes security.

Basic knowledge of Web3 and smart contract security.

Basic scripting or programming skills, preferably in Python or another relevant language.

Ability to clearly communicate security risks and remediation guidance to both technical and non-technical stakeholders.

Native Ukrainian and English at a B1 level.