Senior Application Security Engineer

TL;DR

Senior Application Security Engineer (AppSec): Ensuring the security of high-performance web applications throughout the SDLC with an accent on threat modeling, manual code reviews, and vulnerability mitigation. Focus on building secure development processes, managing bug bounty programs, and providing expert consulting to product teams to maintain robust security posture.

Location: Must be based in Poland or Serbia

Company

A leading technology company providing innovative software solutions for the iGaming industry.

What you will do

• Partner with product teams to lead threat modeling and risk assessments during the design phase.
• Perform in-depth manual code reviews to identify complex logical vulnerabilities.
• Plan, design, and automate AppSec tools to improve security efficiency.
• Contribute to company-wide processes for secure code development and deployment.
• Triage security vulnerabilities and ensure effective mitigation by development teams.
• Manage the bug bounty program and collaborate with researchers to resolve findings.

Requirements

• 5+ years of experience in Application Security.
• Deep understanding of web application security mechanisms and OWASP Top 10.
• Knowledge of secure system architecture and modern authentication patterns like OAuth, OIDC, and JWT.
• Practical expertise in security assessment and root-cause analysis.
• English and Russian proficiency at B2+ level required.
• University degree in Computer Science, Information Security, or equivalent experience.

Nice to have

• Hands-on DevSecOps experience.
• Participation in bug bounty programs or CTFs.
• Deep knowledge of SAST/DAST tools.
• Relevant certifications such as OSWE or GWEB.

Culture & Benefits

• Private health insurance and comprehensive mental health program.
• Sports benefits and paid time off.
• Free online English lessons and local language courses.
• Maternity leave support and referral program.
• Opportunities for upskilling, internal workshops, and professional conferences.