Application Security Specialist

OPTIVEUM SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ; Wrocław; Hybrid; PLN 120,000 - 180,000; Full time

Job summary

OPTIVEUM SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ poszukuje Specjalisty ds. Bezpieczeństwa Aplikacji do zespołu AppSec Platform & Security Engineering. Do obowiązków należy identyfikacja, ocena i ograniczanie ryzyka bezpieczeństwa w całym cyklu wytwórczym oprogramowania.

Praca w modelu Hybrid, 1 dzień w biurze tygodniowo, 40h/tydz. Wymagane doświadczenie w AppSec, znajomość OWASP, narzędzi SAST/DAST/DAST, CI/CD, kontenery i DevSecOps.

Qualifications

• Degree in Computer Science, Information Security, Cybersecurity or a related field, or equivalent practical experience
• 4–5 years of experience in application security, software security, secure software development or a closely related field
• Hands-on experience with application security assessments, vulnerability analysis or security testing
• Experience working with development teams to identify and fix security issues
• Intermediate programming or scripting skills in Python, Java or .NET, with experience building digital products
• Experience with AppSec tools such as Semgrep, SonarQube, HCL AppScan, ZAP, Black Duck or Sonatype Lifecycle (or comparable)
• Good understanding of OWASP Top 10, OWASP ASVS and other relevant OWASP standards
• Familiarity with SAST, DAST and SCA and their integration into CI/CD pipelines
• Experience with cloud-native application security, containers or Kubernetes
• Familiarity with DevSecOps practices, version control and CI/CD, preferably Jenkins, Git, Docker or Kubernetes
• Understanding of vulnerability management, risk assessment and remediation processes
• Strong analytical skills, attention to detail and the ability to explain technical findings to different audiences
• Collaborative, proactive mindset with a sense of ownership
• Fluent English

Responsibilities

• Support development teams in integrating security into the SDLC and applying secure coding practices
• Perform and support security assessments using AppSec tools, analyse findings, prioritise risks and guide teams through vulnerability remediation
• Work with SAST, DAST, SCA and other security testing technologies to identify risks in applications
• Contribute to threat modelling, security design reviews and the use of established security patterns
• Support integration and improvement of AppSec tools and processes within CI/CD pipelines and development workflows
• Contribute to security awareness activities, training materials and guidance for development teams
• Help teams implement security requirements, standards and internal policies
• Identify opportunities to improve AppSec processes, tooling and ways of working
• Communicate findings, explain risks and support practical remediation with developers, architects and security colleagues

Skills

CS/cybersecurity degree

Security testing

AppSec tools

OWASP awareness

CI/CD security

Cloud-native security

DevSecOps

Vulnerability mgmt

Python/Java/.NET

Team collaboration

Fluent English

Education

Degree in CS/Info Sec

Tools

Semgrep

SonarQube

HCL AppScan

ZAP

Black Duck

Sonatype Lifecycle

Job description

Nasze wymagania:

• Degree in Computer Science, Information Security, Cybersecurity or a related field, or equivalent practical experience


• 4–5 years of experience in application security, software security, secure software development or a closely related field


• Hands-on experience with application security assessments, vulnerability analysis or security testing


• Experience working with development teams to identify and fix security issues


• Intermediate programming or scripting skills in Python, Java or .NET, with experience building digital products


• Experience with AppSec tools such as Semgrep, SonarQube, HCL AppScan, ZAP, Black Duck or Sonatype Lifecycle (or comparable)


• Good understanding of OWASP Top 10, OWASP ASVS and other relevant OWASP standards


• Familiarity with SAST, DAST and SCA and their integration into CI/CD pipelines


• Experience with cloud-native application security, containers or Kubernetes


• Familiarity with DevSecOps practices, version control and CI/CD, preferably Jenkins, Git, Docker or Kubernetes


• Understanding of vulnerability management, risk assessment and remediation processes


• Strong analytical skills, attention to detail and the ability to explain technical findings to different audiences


• Collaborative, proactive mindset with a sense of ownership


• Fluent English

Mile widziane:

• Experience with threat modelling and security design reviews


• Familiarity with NIST, OWASP DSOMM and OWASP SAMM


• Application security or cybersecurity certifications


• Awareness of emerging regulations such as the EU Cyber Resilience Act (CRA)

O projekcie:

We are currently looking for an Application Security Specialist to join the AppSec Platform & Security Engineering team of our global client from the industrial sector. For this role, Optiveum is the recruitment and contracting party, which means you will sign the cooperation agreement directly with us. You will help development teams build secure software by identifying, assessing and mitigating security risks across the entire software development lifecycle. Work Model: Hybrid, approx. 1 day per week in the office (75% remote), full-time (40h/week)

Zakres obowiązków:

• Support development teams in integrating security into the SDLC and applying secure coding practices


• Perform and support security assessments using AppSec tools, analyse findings, prioritise risks and guide teams through vulnerability remediation


• Work with SAST, DAST, SCA and other security testing technologies to identify risks in applications


• Contribute to threat modelling, security design reviews and the use of established security patterns


• Support integration and improvement of AppSec tools and processes within CI/CD pipelines and development workflows


• Contribute to security awareness activities, training materials and guidance for development teams


• Help teams implement security requirements, standards and internal policies


• Identify opportunities to improve AppSec processes, tooling and ways of working


• Communicate findings, explain risks and support practical remediation with developers, architects and security colleagues