Application Security Architect

Papaya Global; Kraków; On-site; PLN 200,000 - 350,000; Full time

Job summary

Papaya Global is seeking an Application Security / Security Architect to embed security across the application lifecycle, partnering with R&D, DevOps/Cloud, product, and the cybersecurity team to improve the security of applications, APIs, repositories, data stores, and application‑facing cloud services.

You will combine architecture, threat modeling, secure software development, vulnerability validation, and practical engineering partnership to turn findings into clear remediation work for

Qualifications

• 4+ years of hands-on experience in application security, product security, or security architecture.
• Strong understanding of secure software development lifecycles, threat modeling, security requirements, architecture reviews, and practical risk assessment.
• Hands-on experience with web applications, APIs, microservices, authentication, authorization, data protection, secrets management, and service-to-service communication.
• Code-reading or code-review experience in modern programming languages and ability to explain security issues clearly to engineers.
• Background as a software developer or DevOps/software architecture with daily coding exposure.
• Experience with application-security tooling such as SAST, DAST, SCA, secret scanning, CSPM, or security testing platforms.
• Experience validating vulnerabilities and managing remediation from discovery through verified closure.
• Strong written and verbal communication; ability to influence R&D, DevOps, product, and business stakeholders without authority.
• Experience using AI tools in engineering work for vulnerability analysis, AI-assisted code review, triage, and exploit development.

Responsibilities

• Own and mature the application-security and security-architecture program across product and internal applications, APIs & services, and data stores.
• Conduct threat modeling, architecture reviews, security design reviews, and risk assessments for new systems and materially changed services.
• Define application-security requirements, review triggers, and practical security patterns for authentication, authorization, secrets, data protection, input handling, APIs, service-to-service communication, and security logging.
• Review source code, high-risk configurations, CI/CD security checks, and application integrations with engineering teams; provide actionable guidance to enhance security posture.
• Validate and prioritize findings from vulnerability-management and security-assessment tooling, penetration tests, and other security assessments - distinguish true risk from noise, and translate findings into clear engineering tasks and track their status.
• Own the operating process for penetration testing and bug bounty programs, including scope, intake, triage, communication, remediation tracking, and verification of fixes.
• Identify recurring vulnerability themes and root causes, then drive preventive improvements in engineering practices, tooling, architecture, and developer enablement.
• Partner with Security Operations to provide application context, logging requirements, detection opportunities, and context relevant to monitoring and incident response.

Skills

Application security

Threat modeling

Secure SDLC

Security architecture

API security

Code review

CI/CD security

Tools

SAST

DAST

SCA

CSPM

Vulnerability management

Bug bounty tooling

Job description

Papaya Global is seeking an Application Security / Security Architect to embed security across the application lifecycle, partnering with R&D, DevOps/Cloud, product, and the cybersecurity team to improve the security of applications, APIs, repositories, data stores, and application‑facing cloud services.

You will combine architecture, threat modeling, secure software development, vulnerability validation, and practical engineering partnership to turn findings into clear remediation work for