AppSec - Vulnerability Management Engineer

Jobless; Fatih; On-site; TRY 180,000 - 280,000; Full time

Job summary

Trendyol is seeking an Application Security Engineer to work with our engineering teams to strengthen security across web and mobile platforms. You will test, validate fixes, and guide secure coding practices.

You’ll support the bug bounty program and build custom tools to improve threat detection. The role requires collaboration, clear communication, and a proactive security mindset to promote best practices throughout the organization.

Qualifications

• Proven web and mobile security testing experience.
• Experience addressing OWASP Top 10 vulnerabilities.
• Ability to perform root-cause analysis and remediation guidance.
• Experience with bug bounty platforms and tooling.
• Familiarity with front-end and back-end frameworks.

Responsibilities

• Collaborate with engineering to enhance application security across platforms.
• Perform web and mobile security testing and validate fixes via code reviews.
• Develop custom security tools and security rules (Semgrep/Nuclei).
• Guide secure coding practices and promote security across teams.
• Manage Bug Bounty Platform and remediation workflows.

Skills

Web security testing

Mobile security testing

Secure coding guidance

Programming languages

Communication skills

Education

Professional certifications in application security (eWPT, eWPTXv2, OSWE, eMAPT, GWAPT)

Tools

Semgrep

Nuclei

OWASP ZAP

Job description

ABOUT THE TEAM

We’re shaping the future of financial technology at Trendyol.

As Trendyol’s technology teams, we’re not only building for today we’re designing the financial experiences of tomorrow. From payment infrastructure and digital wallets to smart credit systems and personalized financial services, we create solutions that empower millions of users across our ecosystem.

With Trendyol Pay, we enable fast, secure, and seamless payment journeys. Through Trendyol Finance, we develop inclusive and accessible products that simplify financial decisions.

We are united by a shared purpose:To create a positive impact in our ecosystem by enabling commerce through technology

About the Role

As an Application Security Engineer, you’ll work closely with Trendyol’s engineering teams to enhance application security across our platforms. You’ll perform web and mobile security testing, validate fixes through code reviews, and provide expert guidance on secure coding practices. In this role, you’ll support our bug bounty program, develop custom security tools, and help drive root-cause analysis and remediation. We’re looking for a collaborative, open-minded teammate who is eager to improve, communicate clearly, and promote security best practices throughout the organization.

Your Main Responsibilities:

• Ability to work collaboratively in a team environment and is a friendly, humble, responsible teammate.


• Be a subject matter expert and guidance to Trendyol Engineering for secure coding practices, application security.


• Experience in performing web security testing on web applications and mobile applications.


• Ensuring to confirm of the fix of the vulnerability by making manual code review on the relevant commit.


• Experience identifying and protecting against web application and web-service security vulnerabilities including those found in the OWASP Top 10.


• Experience in fixing vulnerabilities, documenting and remediation guidance for discovered vulnerabilities.


• Developing custom security tools and security rules(e.g. Semgrep / Nuclei)


• Promoting security best practices among developers.


• Ability to conduct root cause analysis against vulnerabilities and determine feasible technical solutions.


• Managing Bug Bounty Platform.

Qualities We Are Looking For:

• Experience with multiple programming/scripting languages (such as, Java, Golang, Python etc.)


• Having excellent communication skills.


• Experience with vulnerability management and enterprise remediation efforts.


• Being an Agile minded team player.


• Eagerness on self-improvement, open-minded, future-oriented.


• English language skills for reading technical documentation and to fix the vulnerabilities with international developers.


• Professional certification (e.g. eWPT, eWPTXv2, OSWE, eMAPT, GWAPT) preferred.


• Familiarity with front-end and back-end web application frameworks (i.e. Spring, Gin, React, etc).


• Bonus points for community contributions like public CVEs, bug bounty recognition, blogs, etc.