Application & AI Security Engineer

AdTech Holding; United States; Remote; USD 110,000 - 150,000; Full time

Benefits offered by this job

health insurance

sick leave 10 days paid

additional 5 days off per year

english/other language bonuses

Job summary

AdTech Holding ищет инженера по безопасности приложений и ИИ для работы в отделе безопасности. В обязанности входит проведение обзоров безопасности, threat modeling, контроль анализа кода и зависимостей, а также аудит и тестирование API и интеграций.

Требуется опыт 3+ года в безопасности приложений, знание OWASP и работа с Burp/ZAP, а также интерес к безопасности LLM и автономных AI-систем. Владеете русским и английским языками на рабочем уровне.

Qualifications

• 3+ года опыта в области безопасности приложений (code & architecture)
• Сильные навыки ручного тестирования и опыт SAST/DAST
• Понимание авторизации: OAuth/OIDC/JWT
• Умение читать PHP, Go и JavaScript; автоматизация на Python/Bash
• Способность влиять на команды через security champions
• Интерес к LLM security: prompt injection, доступ к данным
• Владеете русским и английским языками на рабочем уровне
• Manual testing с Burp Suite или ZAP
• Static analysis
• Dependency scanning
• Secret detection
• Vulnerability management
• OWASP Top 10
• OWASP API Security Top 10
• OWASP Top 10 for LLM Applications
• ASVS

Responsibilities

• Проводить security reviews сервисов, интеграций и API до продакшена
• Проводить threat modeling новых фич
• Контролировать статический анализ и сканирование зависимостей
• Участвовать в управлении уязвимостями и багбаунти
• Обеспечивать безопасность AI интеграций и доступ к аккаунтам
• Проводить penetration-тесты и аудиты
• Разрабатывать и поддерживать стандарты безопасной разработки

Skills

Опыт в обеспечении безопасности прилож

SAST/DAST/SCA

OWASP Top 10

OWASP API Security Top 10

LLM безопасность приложений

RBAC/OAuth/OIDC/JWT

Python/Bash автоматизация

Education

OSWE или GWEB

Tools

Burp Suite

ZAP

SonarQube

Nessus

Job description

Описание: AdTech Holding is an Innovation hub based in Cyprus, which creates vibrant startup ecosystems and technologies for AdTech & MarTech projects. Since 2011, AdTech Holding has been a starting point for an array of industry-leading advertising and digital marketing companies (PropellerAds, Zeydoo etc). Holding brings the most daring ideas to the market and creates cutting-edge solutions to deliver technology globally. We are looking for an Application and AI Security Engineer for our Security Department!

Задачи

• Run security reviews of services, integrations and public APIs before they go to production, including manual review of critical code.
• Do threat modeling for new features with product teams at the design stage.
• Own security checks in the development lifecycle (static analysis, dependency scanning, secret detection), covering coverage, rules and triage of findings with teams.
• Build a unified vulnerability management process, including the vulnerability register, prioritization, SLAs, retesting and bug bounty.
• Secure AI integrations and define access policies for service and AI agent accounts.
• Run penetration tests and audits: scope them, accept the results and follow findings through to systemic fixes.
• Develop and maintain standards and practices for developers, including secure development requirements, guidelines and team training.

Требования

• 3+ years of experience in application security, covering code and architecture reviews, SAST, DAST, SCA and OWASP.
• Strong manual testing skills and hands-on experience with static analysis, including writing your own custom rules.
• A solid understanding of how authorization works in practice: OAuth, OIDC, JWT, token scopes and delegated permissions.
• Ability to read PHP, Go and JavaScript code and to automate tasks in Python or Bash.
• Ability to drive results with teams you don’t manage directly, including through security champions.
• Interest in LLM application security, such as prompt injection and AI agents’ access to data.
• Working proficiency in Russian and English.
• Manual testing with Burp Suite or ZAP
• Static analysis
• Dependency scanning
• Secret detection in code
• Vulnerability management
• OWASP Top 10
• OWASP API Security Top 10
• OWASP Top 10 for LLM Applications
• ASVS

Our stack

• Languages: PHP (Symfony), Go, JavaScript/TypeScript, Python
• Data: PostgreSQL, MySQL, ClickHouse
• CI/CD: Docker, GitLab/GitHub, TeamCity
• Security: SonarQube, Nessus
• OS: Linux
• Experience in AdTech or other high-load environments
• DevSecOps experience
• Experience testing LLM applications
• Bug bounty or CTF experience
• OSWE or GWEB certification

Benefits

• freedom of choice: cafeteria benefits system where you can choose which benefits would fit your individual needs
• health insurance
• fully covered 10 working days of sick leave per year
• 5 additional day-offs per year
• English and other languages compensation, quarterly, and annual bonuses
• corporate events
• gifts
• gym at the office
• food (yummy!)
• snacks in our worldwide working spaces
• breakfasts & lunches in the offices