Applied Security Engineer – Web Apps & APIs

Jobtailor; Warszawa; On-site; PLN 120,000 - 180,000; Full time

Job summary

Jobtailor is seeking an Application Security professional to triage and analyze findings from SAST/SCA and secret scans, conduct manual and tool-assisted code reviews, and perform hands-on penetration testing of web apps, microservices, and APIs.

You will audit REST and GraphQL APIs, focusing on authentication, authorization, and business logic, applying OWASP Top 10 and API Security Top 10 principles. Collaboration with engineering and DevOps is essential.

Qualifications

• 2–4 years of experience in Application Security, Product Security, or Penetration Testing.
• Hands‑on experience triaging and analyzing findings from Semgrep / OpenGrep, Gitleaks, Trivy, and OSV-Scanner.
• Experience with Burp Suite (Pro), Nuclei, Subfinder, SQLmap, Metasploit, and NetzScum?
• Deep understanding of OWASP Top 10 vulnerabilities, including SQLi, XSS, CSRF, broken access control, and security misconfigurations.
• Solid knowledge of OWASP API Security Top 10 for REST and GraphQL architectures.

Responsibilities

• Triage, validate, and prioritize security findings from SAST, SCA, and secret scanning tools; filter false positives, assess risks, and track issues through remediation.
• Conduct manual and tool-assisted code reviews to identify vulnerabilities before production.
• Perform hands-on penetration testing of web applications, microservices, and APIs.
• Audit REST and GraphQL APIs and web applications focusing on authentication, authorization, and business logic.

Skills

Security findings triage

Code review

Vulnerability assessment

Risk analysis

Penetration testing

API security

OAuth 2.0

JWT

RBAC/ABAC

Tools

Burp Suite (Pro)

Nuclei

SQLmap

Metasploit

Trivy

Gitleaks

OSV-Scanner

Kubernetes Security

AWS Cloud Security

Job description

Jobtailor is seeking an Application Security professional to triage and analyze findings from SAST/SCA and secret scans, conduct manual and tool-assisted code reviews, and perform hands-on penetration testing of web apps, microservices, and APIs.

You will audit REST and GraphQL APIs, focusing on authentication, authorization, and business logic, applying OWASP Top 10 and API Security Top 10 principles. Collaboration with engineering and DevOps is essential.