Application Security Engineer (AppSec)

W Group; København; On-site; DKK 700,000 - 900,000; Full time

Benefits offered by this job

24 calendar days of paid leave

Additional days off for national holyd

Job summary

WhiteBIT is shaping the new Web3 era and seeks an Application Security Engineer to protect our blockchain platform used by millions. You will perform thorough security assessments, review code, and drive secure development across our products.

You’ll triage bug bounty submissions, coordinate remediation, and help enforce security standards throughout the SDLC. Join a global fintech team focused on transparency, fast iteration, and secure architecture in a dynamic environment that values

Qualifications

• 2+ years of experience in Application Security, Product Security, or a related security role.
• Strong knowledge of web application security, OWASP Top 10, common attack techniques, and secure coding practices.
• Hands-on experience with threat modeling, security architecture reviews, vulnerability assessment, and penetration testing.
• Ability to review source code and identify security vulnerabilities.
• Experience with SAST, DAST, SCA, secrets scanning, and vulnerability-management tools.
• Understanding of CI/CD pipelines and experience integrating security checks into the SDLC.
• Knowledge of API security, authentication, authorization, and common security protocols.
• Familiarity with cloud, container, or Kubernetes security.
• Basic knowledge of Web3 and smart contract security.
• Basic scripting or programming skills, preferably in Python or another relevant language.
• Ability to clearly communicate security risks and remediation guidance to technical and non-technical stakeholders.

Responsibilities

• Perform application security assessments, source-code reviews, and penetration testing.
• Participate in threat modeling and security architecture reviews for new and existing products.
• Triage Bug Bounty submissions: validate and reproduce vulnerabilities, assess severity, identify duplicates and false positives, communicate with researchers, and coordinate remediation with engineering teams.
• Identify, prioritize, and track vulnerabilities throughout the remediation process.
• Provide developers with clear remediation guidance and secure coding recommendations.
• Support the integration and operation of SAST, DAST, SCA, secrets scanning, and other security tools within CI/CD pipelines.
• Participate in defining and reviewing security requirements throughout the software development lifecycle.
• Validate security-tool findings and help reduce false positives.
• Support investigations and remediation of application-related security incidents.
• Contribute to application security standards, guidelines, and reusable security controls.
• Help deliver security training and promote secure development practices across engineering teams.
• Collaborate with developers, DevOps, QA, product teams, and other security specialists.
• Monitor emerging application security threats and contribute to improving AppSec processes.

Skills

Application Security

Threat Modeling

Security Architecture

Vulnerability Assessment

Penetration Testing

CI/CD Security

SAST

DAST

SCA

Cloud Security

Kubernetes Security

Python scripting

Communication skills

Ukrainian

English (B1)

Tools

Python

Job description

We are the creators of a new fintech era!

Our mission is to change this world by making blockchain accessible to everyone in everyday life. WhiteBIT is a global team of over 1,200 professionals united by one mission — to shape the new world order in the Web3 era. Each of our employees is fully engaged in this transformative journey.

We work on our blockchain platform, providing maximum transparency and security for more than 8 million users worldwide. Our breakthrough solutions, incredible speed of adaptation to market challenges, and technological superiority are the strengths that take us beyond ordinary companies. Our official partners include the National Football Team of Ukraine, FC Barcelona, Lifecell, FACEIT and VISA.

The future of Web3 starts with you: join us as an Application Security Engineer!

Requirements

• 2+ years of experience in Application Security, Product Security, or a related security role.
• Strong knowledge of web application security, OWASP Top 10, common attack techniques, and secure coding practices.
• Hands-on experience with threat modeling, security architecture reviews, vulnerability assessment, and penetration testing.
• Ability to review source code and identify security vulnerabilities.
• Experience with SAST, DAST, SCA, secrets scanning, and vulnerability-management tools.
• Understanding of CI/CD pipelines and experience integrating security checks into the SDLC.
• Knowledge of API security, authentication, authorization, and common security protocols.
• Familiarity with cloud, container, or Kubernetes security.
• Basic knowledge of Web3 and smart contract security.
• Basic scripting or programming skills, preferably in Python or another relevant language.
• Ability to clearly communicate security risks and remediation guidance to technical and non-technical stakeholders.

Responsibilities

• Perform application security assessments, source-code reviews, and penetration testing.
• Participate in threat modeling and security architecture reviews for new and existing products.
• Triage Bug Bounty submissions: validate and reproduce vulnerabilities, assess their severity and business impact, identify duplicates and false positives, communicate with researchers, and coordinate remediation with engineering teams.
• Identify, prioritize, and track vulnerabilities throughout the remediation process.
• Provide developers with clear remediation guidance and secure coding recommendations.
• Support the integration and operation of SAST, DAST, SCA, secrets scanning, and other security tools within CI/CD pipelines.
• Participate in defining and reviewing security requirements throughout the software development lifecycle.
• Validate security-tool findings and help reduce false positives.
• Support investigations and remediation of application-related security incidents.
• Contribute to application security standards, guidelines, and reusable security controls.
• Help deliver security training and promote secure development practices across engineering teams.
• Collaborate with developers, DevOps, QA, product teams, and other security specialists.
• Monitor emerging application security threats and contribute to improving AppSec processes.
• Ukrainian (Native)
• English (B1)

Working terms

Immerse yourself in Crypto & Web3:

• Master cutting-edge technologies and become an expert in the most innovative industry.

Work with the Fintech of the Future:

• Develop your skills in digital finance and shape the global market.

Take Your Professionalism to the Next Level:

• Gain unique experience and be part of global transformations.

Drive Innovations:

• Influence the industry and contribute to groundbreaking solutions.

Join a Strong Team:

• Collaborate with top experts worldwide and grow alongside the best.

Work-Life Balance & Well-being:

• Modern equipment.
• Comfortable working conditions, and an inspiring environment to help you thrive.
• 24 calendar days of paid leave.
• Additional days off for national holidays.

With us, you’ll dive into the world of unique blockchain technologies, reshape the crypto landscape, and become an innovator in your field.

Let’s Build the Future Together!

WhiteBIT offers all candidates an equal opportunity to join the team. All hiring decisions are made without regard to race, national origin, gender identity or sexual orientation, age, religion, disability, medical condition, marital status, familial status, veteran status, or any other legally protected characteristic of an individual.

Your privacy matters to us. You can learn more about how we handle yourpersonal data with regard to your application in our Candidate Privacy Notice.