security engineer in application security

Описания нет

• Construct local test environments, dependency mocks, and reproduction harnesses to validate reported security findings
• Distinguish exploitable vulnerabilities from scanner false positives and attach reproducible evidence to issue tickets
• Review and validate code patches generated by automated and AI-driven remediation systems
• Inspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and functional regressions
• Run unit, integration, and differential tests to confirm fix efficacy and build stability, targeting a ≥90% patch acceptance rate without major revision
• Review, filter, and prioritize findings from automated static and dynamic/endpoint scanning tools within 24–48 hours
• Classify vulnerability severity using standardized scoring rubrics and map valid findings to remediation SLAs
• Evaluate compliance exception requests against security policies and escalate ambiguous, disputed, or architectural edge cases
• Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services
• Maintain threat models and service risk classification tags in centralized repositories
• Route verified, test-passing security patches to product engineering owners
• Shepherd fixes through code review, track remediation SLAs, and verify deployment to production

• 5+ Years of hands-on experience in Application Security, Product Security, or Software Engineering, focused on vulnerability validation, secure code review, and test automation
• Proficiency in reading, writing, and debugging at least two of C++, Go, Java, or Python, including setting up local test harnesses, mocking dependencies, and building minimal PoCs
• Deep understanding of secure coding standards, including input validation, boundary checking, safe memory access, and concurrency safety
• Knowledge of CWE, CVE, OWASP Top 10, vulnerability scoring matrices, and SLA-driven remediation workflows
• Understanding of architectural trust boundaries, data flows, attack surfaces, and threat modeling frameworks such as STRIDE and PASTA
• Clear written and verbal communication skills for documenting reproduction steps, justifying severity classifications, and collaborating with software engineering owners through code review
• Будет плюсом: experience validating, debugging, or prompt-tuning automated code generation tools; automated patch validation and differential testing; fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across services

• Remote hiring locations: Poland