Senior AppSec Engineer | Metrics & Penetration Testing

SpotOn; Kraków; Hybrid; PLN 211,000 - 264,000; Full time

Benefits offered by this job

Competitive pay (PLN net on B2B)

Training budget

Private healthcare

Relocation package within Poland

MacBook Pro + monitors

Flexible working hours

Job summary

SpotOn is seeking a Senior Application Security Engineer to own and mature our AppSec program. You will manage the scanning stack (SAST, DAST, SCA, and secrets), coordinate third-party penetration testing engagements, and drive forward AI/ML testing and threat modeling initiatives.

This role requires defining metrics, reporting to leadership, and ensuring findings are triaged and remediated, working with developers in a fully qualified, independent capacity within the hybrid Kraków office.

Qualifications

• 5+ years of experience in application security, secure code review, or a related engineering/security discipline.
• Availability to work in a hybrid work model.
• Experience building or owning security metrics and reporting, ideally with exposure to communicating program health to non-technical or executive audiences.
• Hands-on experience with SAST, DAST, and SCA tooling, and with vulnerability management platforms such as DefectDojo.
• Demonstrated experience coordinating or directly performing penetration testing, including working with external testing vendors.
• Familiarity with container security concepts and admission control.

Responsibilities

• Define and own the metrics framework for the AppSec program: what gets measured, why it matters, and how it ties to risk reduction.
• Establish baselines for each metric to track program trajectory over time.
• Build recurring reporting that translates raw data into a narrative leadership can act on.
• Prepare materials for Head of Security to present to Executive leadership, showing program trajectory.

Skills

Security metrics

Executive reporting

Penetration testing

Threat modelling

AI/ML security testing

PCI DSS familiarity

Cloud security

Container security

Communication skills

Independent judgment

Education

Bachelor's degree in Computer Science, Information Security, or related field

Tools

SAST

DAST

SCA tooling

DefectDojo

Job description

SpotOn is seeking a Senior Application Security Engineer to own and mature our AppSec program. You will manage the scanning stack (SAST, DAST, SCA, and secrets), coordinate third-party penetration testing engagements, and drive forward AI/ML testing and threat modeling initiatives.

This role requires defining metrics, reporting to leadership, and ensuring findings are triaged and remediated, working with developers in a fully qualified, independent capacity within the hybrid Kraków office.