Application Specialist

Ework Group; Wrocław; Hybrid; PLN 180,000 - 240,000; Full time

Job summary

Ework Group is seeking a skilled Mid Application Security Engineer to join the AppSec Platform & Security Engineering team in a global industrial organization. The role focuses on securing software across the development lifecycle and collaborating with engineering teams to mitigate risks.

You will apply SAST/DAST/SCA tools, participate in threat modelling, and help integrate security into CI/CD workflows. Strong hands-on experience and the ability to clearly communicate risks are essential.

Qualifications

• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity or related field, or equivalent practical experience.
• 4-5 years of relevant experience in application security and secure software development.
• Hands-on experience with application security assessments and security testing.
• Experience collaborating with development teams to fix security issues.
• Programming or scripting skills in Python, Java or .NET.
• Familiarity with AppSec tools and OWASP standards.
• Understanding of CI/CD security and DevSecOps practices.

Responsibilities

• Support development teams in integrating security into the SDLC and secure coding practices.
• Perform and support security assessments using AppSec tools and guide remediation.
• Work with SAST, DAST and SCA to identify risks in applications.
• Contribute to threat modelling, security design reviews and secure patterns.
• Improve AppSec tooling and CI/CD integration within pipelines.
• Create security awareness materials and provide guidance to teams.
• Define and implement security requirements and policies with stakeholders.
• Identify opportunities to enhance AppSec processes and workflows.

Skills

Application security

Secure coding

CI/CD security

SAST/DAST/SCA

Python/Java/ .NET

Threat modelling

Communication

Education

Bachelor's or Master's in CS/Info Security

Tools

Semgrep

SonarQube

HCL AppScan

ZAP

Black Duck

Sonatype Lifecycle

Job description

For our Client, we are looking for a Mid Application Security Engineer - 2 days at the office in Wroclaw required

We are looking for a Professional Application Security Engineer to join the AppSec Platform & Security Engineering team in a global industrial organization.

You will help development teams build secure software by identifying, assessing and mitigating security risks throughout the entire software development lifecycle.

Key responsibilities

• Support development teams in integrating security into the software development lifecycle and applying secure coding practices.
• Perform and support security assessments using application security tools, analyze findings, prioritize risks and guide teams in remediating vulnerabilities.
• Work with SAST, DAST and SCA tools and other security testing technologies to identify potential risks in applications.
• Contribute to threat modelling, security design reviews and the application of established security patterns.
• Support the integration and improvement of AppSec tools and processes within CI/CD pipelines and development workflows.
• Contribute to security awareness activities, training materials and guidance for development teams.
• Help teams implement relevant security requirements, standards and internal policies.
• Identify opportunities to improve AppSec processes, tooling and ways of working.
• Communicate security findings, explain risks and support practical remediation together with developers, architects and security colleagues.

What we are looking for:

• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity or a related field, or equivalent practical experience.
• 4-5 years of relevant experience in application security, software security, secure software development or a closely related technical field.
• Hands-on experience with application security assessments, vulnerability analysis or security testing.
• Experience working with software development teams to identify and address security issues.
• Experience writing code and developing digital products; intermediate programming or scripting skills in Python, Java or .NET.
• Experience with AppSec tools such as Semgrep, SonarQube, HCL AppScan, ZAP, Black Duck or Sonatype Lifecycle (or comparable).
• Good understanding of common application vulnerabilities and security standards: OWASP Top 10, OWASP ASVS and other relevant OWASP standards.
• Familiarity with SAST, DAST and SCA and their integration into CI/CD pipelines.
• Experience with cloud-native application security, containers or Kubernetes.
• Familiarity with DevSecOps practices, version control and CI/CD pipelines, preferably Jenkins, Git, Docker or Kubernetes.
• Understanding of vulnerability management, risk assessment and remediation processes.
• Soft skills: strong analytical and problem-solving skills, attention to detail, clear written and verbal communication (including explaining technical findings to different audiences), collaborative approach, proactive mindset and ownership, willingness to learn and share knowledge.