Senior AppSec Engineer: Pen Tests, Threat Modeling, Java

SoftServe; Polska; On-site; PLN 180,000 - 240,000; Full time

Job summary

SoftServe is seeking a senior security professional to lead application-focused penetration testing across web apps, APIs, and services. You will collaborate with Engineering to validate security controls, model threats early in development, and guide remediation with concrete fixes.

Ideal candidates have hands-on experience with Java, C#, Perl, and scripting, plus strong OWASP knowledge and tool proficiencies. You will mentor junior staff and contribute to secure-by-design initiatives.

Qualifications

• At least 6 years in penetration testing or application security with broad tech exposure.
• Hands-on with Java, Struts, C#, and Perl in development environments.
• Experience with Alpine Linux, Envoy Proxy, Jetty and container hardening.
• Familiarity with threat modeling methods such as STRIDE or PASTA.
• Strong knowledge of OWASP Top 10, API Security Top 10, and ASVS guidance.

Responsibilities

• Lead application-focused penetration tests for web apps, APIs, services, and supporting infra.
• Advise development teams on security issues and practical fixes; demonstrate and guide remediation.
• Perform threat modeling and design reviews early in the SDLC to identify risks.
• Conduct source reviews across Java, Struts, C#, Perl, and related tech.
• Translate findings into business risk and present to engineers and execs.
• Develop reports and presentations for technical and executive audiences.
• Develop scripts, tools, and methodologies to mature the assessment program.
• Collaborate with security leadership to define standards and goals for testing.
• Support bug bounty triage, validate findings, and retest fixes.
• Mentor junior team members and security champions.

Skills

Java

C#

Perl

Python

Bash

PowerShell

Threat modeling

OWASP Top 10

Communication

Tools

Burp Suite Pro

SAST tooling

DAST tooling

SCA tooling

Job description

SoftServe is seeking a senior security professional to lead application-focused penetration testing across web apps, APIs, and services. You will collaborate with Engineering to validate security controls, model threats early in development, and guide remediation with concrete fixes.

Ideal candidates have hands-on experience with Java, C#, Perl, and scripting, plus strong OWASP knowledge and tool proficiencies. You will mentor junior staff and contribute to secure-by-design initiatives.