Application Security & Vulnerability Validation Engineer

EPAM Systems Inc; Polska; Hybrid; PLN 180,000 - 300,000; Full time

Benefits offered by this job

Health insurance

Multisport card

Stock Purchase Plan

Relocation opportunities

English classes

Job summary

EPAM Systems Inc. is seeking an experienced Application Security & Vulnerability Validation Engineer to bridge automated security scanning and product engineering.

You will validate exploits, QA AI-generated patches, and ensure secure code fixes are production-ready, within a structured threat modeling framework. Role emphasizes threat modeling, reproducible evidence, and collaboration with software owners to meet remediation SLAs, while leveraging fuzz testing and differential testing in a

Qualifications

• 5+ years of hands-on experience in Application Security, Product Security, or Software Engineering with focus on vulnerability validation, secure code review, and test automation.
• Proficiency in reading, writing, and debugging code in two or more core languages (C++, Go, Java, Python).
• Deep understanding of secure coding standards and memory safety, and high attention to detail when reviewing code diffs for regressions.

Responsibilities

• Construct minimal local test environments and reproduction harnesses to validate findings.
• Distinguish true vulnerabilities from false positives and attach reproducible evidence.
• Review and validate code patches before routing to product code owners.
• Inspect code diffs for logic flaws, hallucinations, and memory safety issues.
• Execute unit, integration, and differential tests to confirm fix efficacy and build stability.
• Route verified patches to engineers and track remediation SLAs.

Skills

C++

Go

Java

Python

Security analysis

Test automation

Tools

SAST tools

Fuzz testing tools

Differential testing

Job description

We are seeking a seasoned Application Security & Vulnerability Validation Engineer to serve as the operational and technical bridge between automated/AI-driven security scanning and remediation systems and product engineering teams.In this role, you will streamline service threat modeling, eliminate scanner triage noise, build minimal proofs-of-concept (PoCs) to validate exploitability, perform rigorous quality assurance on AI/agent-generated security patches, and partner with software engineers to drive confirmed vulnerabilities to verified production closure.ResponsibilitiesConstruct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findingsDistinguish true, exploitable vulnerabilities from scanner false positives and attach clear, reproducible evidence to issue ticketsSupervise, review, and validate code patches generated by automated and AI/agentic remediation systems before they are routed to product code ownersInspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and unintended functional regressionsExecute unit, integration, and differential tests to confirm both fix efficacy and build stability (targeting a 90% patch acceptance rate by code owners without major revision)Review, filter, and prioritize incoming findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24–48 hour turnaround windowClassify vulnerability severity using standardized scoring rubrics and map valid findings to strict remediation SLAsEvaluate standard compliance exception requests against established security policies and escalate ambiguous, disputed, or architectural edge cases to senior security leadsDocument architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority servicesMaintain standardized threat models and service risk classification tags in centralized repositoriesRoute verified, test-passing security patches (changelists / pull requests) to designated product engineering ownersShepherd fixes through code review, track remediation SLAs, and verify end-to-end deployment to productionRequirements5+ years of hands-on experience in Application Security, Product Security, or Software Engineering with a strong focus on vulnerability validation, secure code review, and test automationProficiency in reading, writing, and debugging code in at least two core languages (C++, Go, Java, or Python), with the ability to set up local test harnesses, mock dependencies, and build minimal PoCsDeep understanding of secure coding standards (input validation, boundary checking, safe memory access, concurrency safety) and high attention to detail when reviewing code diffs for regressions, hallucinations, or off-by-one errorsWorking knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflowsUnderstanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks (e.g., STRIDE, PASTA)Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate constructively with software engineering owners through code reviewNice to haveExperience validating, debugging, or prompt-tuning automated code generation tools, along with automated patch validation and differential testingPractical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across servicesWe offerWe gather like-minded people:Top tech minds driving innovation in AI, cloud and digital platform modernizationSupportive team and agile, startup-like cultureHybrid by design mode and opportunity to work remotely within PolandChance to work abroad for up to 60 days annuallyBusiness-driven relocation opportunitiesWe provide growth opportunities:Career development programsThought leadership, mentoring, soft skills and well-being programsCertification (Anthropic, Gemini, GCP, Azure, AWS)English classesWe cover it all:Stable payParticipation in the Employee Stock Purchase Plan with a 15% discountBenefits package (health insurance, multisport, shopping vouchers)Referral bonuses up to $2,000Offices featuring entertainment and relaxation zones, table tennis and football, free snacks, coffee and moreCorporate, social and well-being eventsPlease, note:Benefits listed above are available to employees onlyWe are open for working with Contractors. Terms of B2B cooperation agreements are agreed individuallyWe will reach out to selected candidates exclusivelyEPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.