Senior Application Security Engineer

SpotOn; Kraków; Hybrid; PLN 211,000 - 264,000; Full time

Benefits offered by this job

Competitive pay (PLN net on B2B)

Training budget

Private healthcare

Relocation package within Poland

MacBook Pro + monitors

Flexible working hours

Job summary

SpotOn is seeking a Senior Application Security Engineer to own and mature our AppSec program. You will manage the scanning stack (SAST, DAST, SCA, and secrets), coordinate third-party penetration testing engagements, and drive forward AI/ML testing and threat modeling initiatives.

This role requires defining metrics, reporting to leadership, and ensuring findings are triaged and remediated, working with developers in a fully qualified, independent capacity within the hybrid Kraków office.

Qualifications

• 5+ years of experience in application security, secure code review, or a related engineering/security discipline.
• Availability to work in a hybrid work model.
• Experience building or owning security metrics and reporting, ideally with exposure to communicating program health to non-technical or executive audiences.
• Hands-on experience with SAST, DAST, and SCA tooling, and with vulnerability management platforms such as DefectDojo.
• Demonstrated experience coordinating or directly performing penetration testing, including working with external testing vendors.
• Familiarity with container security concepts and admission control.

Responsibilities

• Define and own the metrics framework for the AppSec program: what gets measured, why it matters, and how it ties to risk reduction.
• Establish baselines for each metric to track program trajectory over time.
• Build recurring reporting that translates raw data into a narrative leadership can act on.
• Prepare materials for Head of Security to present to Executive leadership, showing program trajectory.

Skills

Security metrics

Executive reporting

Penetration testing

Threat modelling

AI/ML security testing

PCI DSS familiarity

Cloud security

Container security

Communication skills

Independent judgment

Education

Bachelor's degree in Computer Science, Information Security, or related field

Tools

SAST

DAST

SCA tooling

DefectDojo

Job description

About SpotOn

We’re not just building restaurant tech, we’re giving independent restaurants the tools to compete and win. From our award-winning point-of-sale to AI-powered profit tools, everything we do helps operators boost profit, work smarter, and keep their best people. And every solution is backed by real humans who actually give a sh*t about helping restaurants succeed.

• Named the #1 Restaurant POS by G2 (Summer 2026), based on ratings from real users

• Rated the top-rated point-of-sale (POS) for restaurants, bars, retail, and small businesses by Capterra users

• Awarded Great Places to Work and Built In’s Best Workplaces for multiple years running

We move fast, care hard, and fight for independent restaurant operators to do what they love, and love doing it. If you’re looking to make an impact with heart and hustle, SpotOn is the place for you.

About the Role:

SpotOn's Information Security team is hiring a Senior Application Security Engineer to own and mature our application security program. This role maintains the security scanning pipeline (SAST, DAST, dependency, and secrets detection), leads third-party penetration testing engagements, and drives forward newer initiatives like AI/ML pen testing and threat modeling.

This person will own program measurement and reporting, building the metrics that demonstrate how our AppSec initiatives are performing and translating that into executive-ready reporting for our Head of Security. This includes defining the right metrics, tracking them consistently, and presenting program trajectory in a way leadership can act on.

This is a fully qualified position: you're expected to work independently within established security practices, exercise judgment on findings triage and prioritization, and be a credible technical resource that developers actively want to loop in.

On a daily basis you will:

Program Measurement & Executive Reporting (priority focus)

• Define and own the metrics framework for the AppSec program: what gets measured, why it matters, and how it ties to risk reduction (examples: mean time to remediate by severity, finding density trends over time, scan coverage across the repo portfolio, pen test finding recurrence rate, PR security review adherence).

• Establish baselines for each metric to track program trajectory over time.

• Build recurring reporting (monthly/quarterly cadence) that translates raw data into a narrative leadership can act on.

• Prepare materials for the Head of Security to present to Executive leadership, showing program trajectory and where initiatives are moving the needle.

Vulnerability Management & Tooling

• Own and maintain the AppSec scanning stack: SAST, DAST, dependency (SCA), and secrets detection across the repo portfolio.

• Ensure findings from all scanners display accurately in inventory system for engineering visibility.

• Tune scanner configurations to reduce noise and false positives, and keep detection coverage current as new repos and services onboard.

Code Review & PR Security Gate

• Establish and maintain a consistent PR review practice for security-relevant changes.

• Track and report on adherence to this process as one of the program's core metrics.

Penetration Testing

• Lead and coordinate application penetration testing engagements with our third-party vendor from scoping through remediation tracking.

• Serve as the primary point of contact for developers who have questions about pen test findings.

• Track pen test outcomes over successive engagements as a measure of whether earlier findings are staying fixed.

Strategic Initiatives

• Design and implement new AppSec initiatives, including AI-specific penetration testing and formal threat modeling practices.

• Define success metrics for each new initiative before it launches, so its impact can be measured rather than assumed.

Container & Supply Chain Security

• Implement and maintain image trust enforcement.

• Partner with Infrastructure/DevOps to ensure image signing and trust policies don't create unnecessary friction in the deployment pipeline.

What skill are we looking for?

• Bachelor's degree in Computer Science, Information Security, or related field (or equivalent practical experience).

• 5+ years of experience in application security, secure code review, or a closely related engineering/security discipline.

• Availability to work in a hybrid work model.

• Demonstrated experience building or owning security metrics and reporting, ideally with exposure to communicating program health to non-technical or executive audiences.

• Hands-on experience with SAST, DAST, and SCA tooling, and with vulnerability management platforms such as DefectDojo.

• Demonstrated experience coordinating or directly performing penetration testing, including working with external testing vendors.

• Familiarity with container security concepts and admission control (Wiz or equivalent).

• Working knowledge of AWS security services and cloud-native application architectures.

• Ability to work with minimal day-to-day direction, exercising independent judgment within established security practices.

• Strong written and verbal communication skills, with the ability to translate technical findings into business-relevant narrative for leadership.

Perfect candidate also has:

• Experience presenting security metrics or dashboards to executive stakeholders.

• Experience with threat modeling frameworks (STRIDE, PASTA, or similar).

• Exposure to AI/ML security testing or red-teaming.

• PCI DSS familiarity.

Here’s a bit about what we have to offer:

• Competitive pay: 18 900 - 23 700 PLN net on B2B.

• Training budget 3500 PLN gross per year.

• Access to e-learning platforms (O’Reilly).

• Fully paid private healthcare in LuxMed.

• Access to the Worksmile platform with a monthly top-up.

• Subsidized access to breakfast and lunch through the vending machine in Kraków office, and lunches in Gdańsk office once a week.

• Group English classes with a native speaker.

• New Macbook Pro, 4K monitors or whatever tools you need.

• Flexible working hours.

• New, modern, bright and comfortable office space in the city centre.

• Access to the company’s library.

• Great working atmosphere.

• Chill out room with a PlayStation and games.

• Free snacks and beverages in a kitchen.

• Company parties and social activities.

• Employee referral program.

• Relocation Package within Poland.

The controller of your personal data included in your job offer and others collected during the recruitment process is SpotOn Poland spółka z ograniczoną odpowiedzialnością with its registered office in Kraków, Aleja 29 listopada 20, 31-401 Kraków, e‑mail address: poland‑[e-mail]. We will process your personal data for the purpose of current or, if you voluntarily agree, also future recruitment processes. More information about how we proccess your data, including the basis for processing and your rights in relation to the processing, can be found on our website: https://pl.spoton.com/privacy-and-cookies-policy. Administratorem podanych danych osobowych, w tym danych zawartych w dokumentach aplikacyjnych i zebranych w toku procesu rekrutacji, jest SpotOn Poland Sp. z o.o. z siedzibą w Krakowie (ul. Aleja 29 listopada 20, 31-401 Kraków; adres e‑mail do kontaktu: poland‑[e-mail]. Dane osobowe będą przetwarzane w celu realizacji obecnych lub – jeżeli wyrazisz na to dobrowolną zgodę – także przyszłych procesów rekrutacji. Więcej informacji o tym, jak przetwarzamy Twoje dane, w tym także informacje o podstawach prawnych przetwarzania oraz o prawach przysługujących Ci w związku z przetwarzaniem danych, znajdziesz na stronie: https://pl.spoton.com/privacy-and-cookies-policy.

SpotOn is an equal employment opportunity employer. Qualified candidates are considered for employment without regard to race, religion, gender, gender identity, sexual orientation, national origin, age, military or veteran status, disability, or any other characteristic protected by applicable law.

For U.S. based roles, work authorization in the U.S. is required. Visa sponsorship is not available for this role.

SpotOn is an E-Verify company.