Application Security Engineer

Whatnot; Kraków; Híbrido; PLN 180 000 - 240 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Remote work option

Global office hubs

Resumo da oferta

Whatnot's Application Security Team protects the products and systems used by buyers and sellers daily. We partner with product and engineering to identify risks, resolve vulnerabilities, and build secure software across web and mobile applications.

As an Application Security Engineer, you will perform security-focused code reviews, work on threat modeling, reproduce and triage vulnerabilities, support the bug bounty program, and help develop reusable security tooling.

Qualificações

• 5 years of relevant experience in application security or software security.
• Experience reviewing code for security vulnerabilities and guiding fixes.
• Understanding of application security risks and how to identify them through threat modeling.

Responsabilidades

• Perform security-focused code reviews and recommend practical fixes.
• Partner with product and engineering on threat modeling and security reviews.
• Help reproduce, triage, and address security vulnerabilities in web and mobile apps.
• Support bug bounty program by investigating reports and remediation.
• Support preparation of security releases.
• Develop security patterns, processes, and automated tooling to prevent issues.

Conhecimentos

Python

Elixir

JavaScript

Threat modeling

Code review

Ferramentas

Security tooling

Descrição da oferta de emprego

Join the Future of Commerce with Whatnot!

Whatnot is the largest live shopping platform in North America and Europe to buy, sell, and discover the things you love. Whether it's trading cards, fashion, electronics, or live plants, our sellers are building real businesses across hundreds of categories. We're building live commerce at a scale that's never been done in the West, and there's no playbook to copy. The people here are shaping how an entirely new industry develops.

As a remote co-located team, we're inspired by our values and anchored in hubs across the US, UK, Ireland, Poland, Germany, and Australia. We move fast, stay close to our users, and focus on the work that drives the most impact.

We're one of the fastest growing marketplaces and were recently named the #1 Best Startup Employer in America by Forbes. Check out the latest Whatnot updates on our news and engineering blogs and join us as we enable anyone to turn their passion into a business and bring people together through commerce.

Role

The Application Security Team at Whatnot helps protect the products and systems that buyers and sellers rely on every day. We partner with product and engineering teams to identify risks, resolve vulnerabilities, and build security into how we develop software. Our work spans web and mobile applications, combining hands-on security reviews with reusable patterns and automated tooling that help teams ship securely.

As an Application Security Engineer, you will:

• Perform security-focused code reviews, identifying vulnerabilities and recommending practical fixes.
• Partner with product and engineering teams on threat modeling and application security reviews.
• Help teams reproduce, triage, and address security vulnerabilities in web and mobile applications.
• Support our bug bounty program by investigating reports and working with teams on remediation.
• Support the preparation of security releases.
• Help develop security patterns, processes, and automated tooling that prevent entire classes of security issues.

We offer flexibility to work from home or from one of our global office hubs, and we value in-person time for planning, problem-solving, and connection. Team members in this role must live within commuting distance of our Krakow hub.

You

People who do well at Whatnot tend to be comfortable figuring things out as they go, biased toward action, and genuinely curious about what they're building. They care more about outcomes than credit and stay close to the product and the people using it.

As our next Application Security Engineer, you should have 5 years of relevant experience, plus:

• Software development experience in one or more of Python, Elixir, or JavaScript.
• The ability to review code for security vulnerabilities and work with engineers to implement effective fixes.
• An understanding of application security risks and how to identify them through threat modelling and security reviews.
• The ability to investigate, reproduce, and triage web and mobile application vulnerabilities.
• Strong communication and collaboration skills, with the ability to explain security risks and recommendations clearly to product and engineering teams.
• A practical approach to problem-solving and an interest in building reusable tools and processes that help prevent security issues.

Please note: Whatnot will only contact you through official @whatnot.com email addresses. If you see an email impersonating a Whatnot recruiter, please disregard and report it as spam.

EOE

Whatnot is proud to be an Equal Opportunity Employer. We value diversity, and we do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, parental status, disability status, or any other status protected by local law. We believe that our work is better and our company culture is improved when we encourage, support, and respect the different skills and experiences represented within our workforce.