Senior Application Security Engineer (Cybersecurity)

Location: Poland or Ukraine; remote or office work

Company

hirify.global provides engineering and technology services with a cybersecurity direction.

What you will do

• Lead application-focused penetration tests covering web applications, APIs, services, and supporting infrastructure.
• Advise engineering and development teams on vulnerabilities, practical fixes, and remediation through closure.
• Conduct threat modeling, software design reviews, and targeted source code reviews across Java, Struts, C#, Perl, Jetty, Envoy Proxy, and Alpine Linux containers.
• Translate technical findings into business risk and prepare reports and presentations for engineering and executive audiences.
• Develop scripts, tools, methodologies, and standards for the application penetration testing program.
• Support bug bounty triage and external penetration tests, retest fixes, and mentor junior security team members.

Requirements

• 10 years of information technology experience, including at least 6 years in penetration testing or application security.
• Software development or engineering background with hands-on Java, Struts, C#, and Perl experience.
• Knowledge of Alpine Linux, Envoy Proxy, Jetty, web and network protocols, authentication frameworks, and common hardening practices.
• Experience with STRIDE, PASTA, or attack trees; software architecture reviews; and OWASP Top 10, API Security Top 10, Testing Guide, and ASVS.
• Expertise with Burp Suite Professional, SAST, DAST, SCA, vulnerability remediation, exploit development, and scripting with Python, Perl, Bash, or PowerShell.
• Exposure to AWS, Docker, Kubernetes, and CI/CD pipelines, plus the ability to communicate clearly and complete work within specified timelines.

Nice to have

• OSCP, OSWE, OSEP, GWAPT, or an equivalent certification.

Culture & Benefits

• Remote or office work options are available.
• Collaboration with Application Security, Red Team, Product Management, and Engineering teams.
• Opportunities to support secure-by-design practices and mentor junior team members and security champions.