ci cdsastthreat modelingapplication securitycloud securitybug bountyapi securitysecure software development
Вакансия из Hirify Global, списка международных tech-компаний Для мэтча и отклика нужен Plus
Пожаловаться
Зарплата и рынок
развернуть
По международному рынку данных пока нет
На СНГ рынке: $4к/мес ($3.7к - $8.2к)
84
Хорошая вакансия
развернуть
Чётко очерченная роль в AppSec в продуктовой компании с ответственностью за SSDLC, инструменты безопасности и AI-процессы; заявленный быстрый темп может означать высокую нагрузку.
Высокий темп
Безопасность AI
Зона ответственности
Свой продукт
Мэтч & Сопровод
Для мэтча с этой вакансией нужен Plus
Подключить Plus
Описание вакансии
Текст:
Hirify AI/Оригинал
TL;DR
Senior Application Security Engineer (AI): Building and operating agentic DevSecOps workflows and SSDLC guardrails for cloud-based applications, APIs, and services with an accent on threat modeling, application security tooling, and vulnerability remediation. Focus on orchestrating security fixes, managing SAST/DAST/IAST findings and bug bounty reports, and enabling engineering teams to deliver secure software.
Location: Tel Aviv, Israel; hybrid
Company
hirify.global is an AI-powered business management platform for service-based business owners, helping them attract leads, manage client relationships, book projects, and process payments.
What you will do
Define remediation strategies with engineering teams and orchestrate agentic workflows that apply security fixes across the application stack.
Design, implement, and drive SSDLC guardrails, including security design reviews, threat modeling, architecture reviews, and production triage.
Assess the security of cloud-based applications, APIs, and services, including solutions using emerging technologies.
Manage the bug bounty program and coordinate validation, response, and resolution of reported issues.
Own AppSec tooling, including SAST, ASPM, and other scanners; triage findings, prioritize risks, and coordinate fixes from penetration tests and external assessments.
Educate and enable engineering, architecture, and DevOps teams while researching application security trends, vulnerabilities, frameworks, and best practices.
Requirements
3+ years of experience in application security, product security, or secure software development.
Experience with modern web application stacks, cloud-native architectures, APIs, and CI/CD pipelines.
Strong understanding of application security principles, OWASP Top 10 vulnerabilities, and secure coding practices.
Experience with SAST, DAST, and IAST tools.
Experience managing bug bounty programs and third-party testing engagements.
Excellent communication skills, including the ability to explain security concepts in developer-friendly language and collaborate across teams.
Ability to balance pragmatic risk mitigation with product velocity, business needs, and user experience.
Growth mindset with a desire to mentor others and continuously improve security posture.
Nice to have
OSCP, GWAPT, CISSP, or CSSLP certification.
Culture & Benefits
Mission-driven product focused on the success of independent businesses.
Fast-paced environment that encourages ownership, innovation, experimentation, and continuous improvement.
Competitive salary and meaningful equity grants.
Wellness programs and family leave policies.
Culture centered on collaboration, feedback, growth, authenticity, respect, transparency, and putting people first.
Будьте осторожны
Если работодатель просит войти в их систему, используя iCloud/Google, прислать код/пароль, запустить код/ПО, не делайте этого. Это мошенники. Обязательно жмите «Пожаловаться» или пишите в поддержку. Подробнее в гайде →