Application Security Engineer

Papaya Global; Kraków; On-site; PLN 300,000 - 420,000; Full time

Job summary

Papaya Global is seeking an Application Security / Security Architect to embed security across the application lifecycle. You will partner with R&D, DevOps/Cloud, product, and cybersecurity to improve security of applications, APIs, repositories, data stores, and cloud services.

You will combine architecture, threat modeling, secure software development, vulnerability validation, and practical engineering partnership to translate findings into prioritized remediation tasks for engineering teams.

Qualifications

• 4+ years of hands-on experience in app security or security architecture.
• Strong understanding of secure SDLC, threat modeling, and risk assessment.
• Hands-on with web apps, APIs, microservices, auth, data protection, secrets management.
• Ability to read code and explain security issues to engineers.
• Experience with vulnerability management and security testing platforms.

Responsibilities

• Own and mature the application-security program across products, APIs, services, and data stores.
• Conduct threat modeling, architecture reviews, and security design reviews.
• Define app-security requirements and practical patterns for auth, data protection, logging.
• Review code and CI/CD security checks; guide engineering to improve security posture.
• Prioritize findings from assessments and translate into actionable tasks.
• Manage penetration testing and bug bounty scope and remediation verification.
• Identify recurring vulnerabilities and drive preventive improvements.
• Collaborate with Security Operations for logging, monitoring, and incident response.

Skills

Application security

Security architecture

Threat modeling

DevOps

Security testing

Vulnerability management

Tools

SAST

DAST

SCA

CI/CD security checks

CSPM

Bug bounty tooling

Job description

Papaya Global is a rapidly growing, award-winning B2B tech unicorn with an ambitious mission to revolutionize the payroll & payments industry. With over $400M raised from multiple tier-one investors, our innovative technology provides a comprehensive solution for managing global workforces, encompassing everything from hiring and onboarding to managing and paying employees in over 160 countries.

We are looking for an Application Security / Security Architect to help embed security across the application lifecycle. In this role, you will partner with R&D, DevOps/Cloud, product, and the cybersecurity team to improve the security of applications, APIs, repositories, data stores, and application-facing cloud services.

You will combine architecture, threat modeling, secure software development, vulnerability validation, and practical engineering partnership. You will review designs and high-risk changes, define security requirements and reusable patterns,validatefindings from vulnerability-management and security-assessment tooling, penetration tests, and bug-bounty activity, and turn those findings into clear, prioritized remediation work for engineering teams.

This role is ideal for someone who can move comfortably between architecture discussions, code and configuration reviews, security testing, and executive-level risk communication. The goal is to help the company build secure applications by design while making application-security decisions faster, clearer, and more measurable.

Responsibilities

• Own and mature the application-security and security-architecture program across product and internal applications, APIs&services, and data stores.
• Conduct threat modeling, architecture reviews, security design reviews, and risk assessments for new systems and materially changed services.
• Define application-security requirements, review triggers, and practical security patterns for authentication, authorization, secrets, data protection, input handling, APIs, service-to-service communication, and security logging.
• Review source code, high-risk configurations, CI/CD security checks, and application integrations with engineering teams;provideactionable guidance to enhance security posture.
• Validate and prioritize findings from vulnerability-management and security-assessment tooling, penetration tests, and other security assessments-distinguish true risk fromnoise,andtranslate findings into clear engineering tasksandtrack their status.
• Own the operating process for penetration testing and bug bounty programs, including scope, intake, triage, communication, remediation tracking, and verification of fixes.
• Identifyrecurring vulnerability themes and root causes, then drive preventive improvements in engineering practices, tooling, architecture, and developer enablement.
• Partner with Security Operations to provide application context, logging requirements, detection opportunities, andcontextrelevant tomonitoringand incident response.

Requirements

• 4+ years of hands-on experience in application security, product security, security architecture, or a closely related role.
• Strong understanding of secure software development lifecycles, threat modeling, security requirements, architecture reviews, and practical risk assessment.
• Hands‑on experience with web applications, APIs, microservices, authentication, authorization, data protection,secretsmanagement, and service‑to‑service communication.
• Practical code-reading or code‑review experience in one or more modern programming languages, with the ability to explain security issues clearly to engineers.
• Background as a software developer, or comparable hands‑on experience as a builder — for example in DevOpsengineering or software architecture — working with code on a daily basis.
• Experience with application‑security tooling or equivalent capabilities, such as vulnerability management, SAST, DAST, SCA, secret scanning, CSPM, or security testing platforms.
• Experiencevalidatingvulnerabilities andmanaging remediation from discovery through verified closure.
• Strong written and verbal communication skills, with the ability to influence R&D, DevOps, product, and business stakeholders without relying on authority alone.
• Experience using AI tools in day‑to‑day engineering work, as well as specifically for vulnerability analysis and exploitation, including AI‑assisted code review, vulnerability triage, and exploit development.

Nice to have

• Experience building or maturing an application-security program in a cloud-native or fast-growing technology environment.
• Experience with security architecture for APIs, distributed systems, containerized or cloud‑native workloads, data stores, CI/CD pipelines, and third‑party integrations.
• Experience coordinating penetration testing, bug‑bounty programs, responsible disclosure, and external security researchers.