Application Security Architect for Secure Apps & APIs

Papaya Global; Kraków; On-site; PLN 300,000 - 420,000; Full time

Job summary

Papaya Global is seeking an Application Security / Security Architect to embed security across the application lifecycle. You will partner with R&D, DevOps/Cloud, product, and cybersecurity to improve security of applications, APIs, repositories, data stores, and cloud services.

You will combine architecture, threat modeling, secure software development, vulnerability validation, and practical engineering partnership to translate findings into prioritized remediation tasks for engineering teams.

Qualifications

• 4+ years of hands-on experience in app security or security architecture.
• Strong understanding of secure SDLC, threat modeling, and risk assessment.
• Hands-on with web apps, APIs, microservices, auth, data protection, secrets management.
• Ability to read code and explain security issues to engineers.
• Experience with vulnerability management and security testing platforms.

Responsibilities

• Own and mature the application-security program across products, APIs, services, and data stores.
• Conduct threat modeling, architecture reviews, and security design reviews.
• Define app-security requirements and practical patterns for auth, data protection, logging.
• Review code and CI/CD security checks; guide engineering to improve security posture.
• Prioritize findings from assessments and translate into actionable tasks.
• Manage penetration testing and bug bounty scope and remediation verification.
• Identify recurring vulnerabilities and drive preventive improvements.
• Collaborate with Security Operations for logging, monitoring, and incident response.

Skills

Application security

Security architecture

Threat modeling

DevOps

Security testing

Vulnerability management

Tools

SAST

DAST

SCA

CI/CD security checks

CSPM

Bug bounty tooling

Job description

Papaya Global is seeking an Application Security / Security Architect to embed security across the application lifecycle. You will partner with R&D, DevOps/Cloud, product, and cybersecurity to improve security of applications, APIs, repositories, data stores, and cloud services.

You will combine architecture, threat modeling, secure software development, vulnerability validation, and practical engineering partnership to translate findings into prioritized remediation tasks for engineering teams.