Application Security Engineer

SNI; Wrocław; On-site; PLN 150,000 - 230,000; Full time

Job summary

SNI is seeking an experienced Application Security Engineer to support secure coding across the SDLC and to implement automated security testing and threat modeling practices. You will work with development teams to identify, prioritize, and remediate vulnerabilities using SAST, DAST, and SCA tools.

The role requires hands-on security tooling, scripting ability, and collaboration with product teams to ensure compliance with internal standards and industry baselines.

Qualifications

• 2–5 years of hands-on experience in application security or secure software development.
• Hands-on with SAST/DAST/ SCA tools and secure coding practices.
• Knowledge of OWASP Top 10, ASVS, and CWE.
• Experience in CI/CD integration and DevSecOps.
• Programming or scripting in Python, Java, or .NET.

Responsibilities

• Assist development teams in adopting secure coding practices across the full SDLC.
• Execute security assessments using SAST, DAST, and SCA tools to identify, prioritize, and remediate vulnerabilities.
• Contribute to threat modeling and security design reviews.
• Integrate security tooling into CI/CD pipelines (DevSecOps).
• Develop security awareness programs and practical guidelines for engineers.
• Support product/platform teams to align with internal security policies and regulatory standards.

Skills

Application security

Secure SDLC

CI/CD security

Threat modeling

Programming/scripting (Python/Java/.NE

Education

Bachelor's or Master's in CS/IS

Tools

Semgrep

SonarQube

HCL AppScan

OWASP ZAP

Black Duck

Sonatype Lifecycle

Job description

SNI is serving as a trusted IT Outsourcing partner in line with the needs of World's most prestigious firms and carried out successful projects worldwide.

Responsibilities:

• Support development teams in adopting secure coding practices and embedding security throughout the full software development lifecycle (SDLC).
• Execute and evaluate security assessments using SAST, DAST, and SCA tooling to identify, prioritize, and remediate application vulnerabilities.
• Contribute to threat modeling, architectural design reviews, and the implementation of established security patterns.
• Integrate and optimize automated application security testing tools and quality gates within CI/CD pipelines (DevSecOps).
• Develop and deliver security awareness programs, training materials, and practical implementation guidelines for engineering teams.
• Assist product and platform teams in aligning with internal security policies, industry baselines, and regulatory compliance standards.
• Continuously refine application security tooling, triage workflows, and vulnerability management processes to boost developer efficiency.
• Communicate vulnerability findings, risk implications, and practical remediation strategies clearly to both technical and non-technical stakeholders.

Skills:

• 2–5 years of hands-on experience in application security, software security engineering, or secure software development.
• Practical experience operating and configuring AppSec tools such as Semgrep, SonarQube, HCL AppScan, OWASP ZAP, Black Duck, Sonatype Lifecycle, or equivalent solutions.
• Solid understanding of core web/API vulnerability classifications and standards, including OWASP Top 10, OWASP ASVS, and CWE.
• In-depth familiarity with Static Application Security Testing, Dynamic Application Security Testing, and Software Composition Analysis.
• Intermediate hands-on programming or scripting capabilities in languages such as Python, Java, or .NET to review application code and automate security tasks.
• Familiarity with CI/CD systems, containerized environments, and cloud-native application security.
• Proven ability to manage vulnerability triage, risk scoring, and tracking issues through remediation.
• Bachelor's or Master's degree in Computer Science, Cybersecurity, Information Security, or equivalent practical industry experience.

Nice to have:

• Hands-on experience conducting threat modeling sessions and architectural security design reviews.
• Familiarity with maturity models and governance frameworks such as NIST, OWASP SAMM, or OWASP DSOMM.
• Awareness of emerging software security regulations, such as the EU Cyber Resilience Act.
• Recognized industry certifications such as CSSLP, CEH, CompTIA Security+, AWS/Azure Security, or GIAC credentials.

Follow us on Linkedin! https://www.linkedin.com/company/snisourcing/posts/?feedView=all PLCY2608