Application Security Engineer (AppSec)

Conduct application security assessments, source-code reviews, and penetration testing.

Participate in threat modeling and security architecture reviews for new and existing products.

Triage Bug Bounty submissions — validating and reproducing vulnerabilities, assessing severity and business impact, identifying duplicates and false positives, communicating with researchers, and coordinating remediation with engineering teams.

Identify, prioritize, and track vulnerabilities through to remediation.

Provide developers with clear guidance on remediation and secure coding practices.

Support the integration and operation of SAST, DAST, SCA, secrets scanning, and other security tools within CI/CD pipelines.

Help define and review security requirements across the software development lifecycle.

Validate findings from security tools and work to reduce false positives.

Support investigations and remediation related to application security incidents.

Contribute to application security standards, guidelines, and reusable security controls.

Help deliver security training and promote secure development practices across engineering teams.

Collaborate with developers, DevOps, QA, product teams, and other security specialists.

Monitor emerging application security threats and help improve AppSec processes.

2+ years of experience in Application Security, Product Security, or a related security role.

Strong knowledge of web application security, the OWASP Top 10, common attack techniques, and secure coding practices.

Hands-on experience with threat modeling, security architecture reviews, vulnerability assessment, and penetration testing.

Ability to review source code and identify security vulnerabilities.

Experience with SAST, DAST, SCA, secrets scanning, and vulnerability-management tools.

Understanding of CI/CD pipelines and experience integrating security checks into the SDLC.

Knowledge of API security, authentication, authorization, and common security protocols.

Familiarity with cloud, container, or Kubernetes security.

Basic knowledge of Web3 and smart contract security.

Basic scripting or programming skills, preferably in Python or another relevant language.

Ability to clearly communicate security risks and remediation guidance to both technical and non-technical stakeholders.

Native Ukrainian and English at B1 level.