Application Security & Vulnerability Validation Engineer

EPAM Systems Inc; United States; Remoto; USD 120.000 - 180.000; Tempo pieno

Descrizione del lavoro

EPAM Systems Inc. is seeking a seasoned Application Security & Vulnerability Validation Engineer to bridge automated security scanning with product engineering. You will streamline threat modeling, reduce scanner noise, and validate AI-generated patches before they reach code owners.

You will also build PoCs to verify exploitability, review patches for correctness, and ensure end-to-end remediation with production deployment. Strong code literacy and security-domain expertise are essential.

Competenze

• 5+ years in Application Security, Product Security, or Software Engineering focusing on vulnerability validation.
• Ability to read, write, and debug code in two languages (C++, Go, Java, or Python).
• Familiarity with CWE, CVE, OWASP Top 10 and vulnerability scoring matrices.
• Experience with threat modeling frameworks (STRIDE, PASTA) and remediation workflows.
• Strong written and verbal communication for cross-functional collaboration.

Mansioni

• Construct test environments and reproduction harnesses to validate findings.
• Differentiate true vulnerabilities from false positives with reproducible evidence.
• Validate code patches produced by automated/AI remediation systems.
• Inspect code diffs for memory safety issues, regressions, or hallucinations.
• Execute unit/integration tests to ensure fix efficacy and stability.
• Prioritize findings from SAST and dynamic scanners within tight SLAs.
• Document entry points, trust boundaries, and data flows for high‑risk services.
• Route patches to product owners and track remediation through deployment.
• Collaborate with engineers to close vulnerabilities in production.

Conoscenze

Security vulnerability validation

Secure code review

Test automation

PoCs

Threat modeling

Descrizione del lavoro

We are seeking a seasoned Application Security & Vulnerability Validation Engineer to serve as the operational and technical bridge between automated/AI-driven security scanning and remediation systems and product engineering teams. In this role, you will streamline service threat modeling, eliminate scanner triage noise, build minimal proofs-of-concept (PoCs) to validate exploitability, perform rigorous quality assurance on AI/agent-generated security patches, and partner with software engineers to drive confirmed vulnerabilities to verified production closure.

Responsibilities

• Construct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findings
• Distinguish true, exploitable vulnerabilities from scanner false positives and attach clear, reproducible evidence to issue tickets
• Supervise, review, and validate code patches generated by automated and AI/agentic remediation systems before they are routed to product code owners
• Inspect code diffs for logic flaws, hallucinations, off‑by‑one errors, memory safety issues, and unintended functional regressions
• Execute unit, integration, and differential tests to confirm both fix efficacy and build stability (targeting a ≥90% patch acceptance rate by code owners without major revision)
• Review, filter, and prioritize incoming findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24–48 hour turnaround window
• Classify vulnerability severity using standardized scoring rubrics and map valid findings to strict remediation SLAs
• Evaluate standard compliance exception requests against established security policies and escape ambiguous, disputed, or architectural edge cases to senior security leads
• Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services
• Maintain standardized threat models and service risk classification tags in centralized repositories
• Route verified, test-passing security patches (changelists / pull requests) to designated product engineering owners
• Shepherd fixes through code review, track remediation SLAs, and verify end-to-end deployment to production

Requirements

• 5+ years of hands‑on experience in Application Security, Product Security, or Software Engineering with a strong focus on vulnerability validation, secure code review, and test automation
• Proficiency in reading, writing, and debugging code in at least two core languages (C++, Go, Java, or Python), with the ability to set up local test harnesses, mock dependencies, and build minimal PoCs
• Deep understanding of secure coding standards (input validation, boundary checking, safe memory access, concurrency safety) and high attention to detail when reviewing code diffs for regressions, hallucinations, or off‑by‑one errors
• Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflows
• Understanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks (e.g., STRIDE, PASTA)
• Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate constructively with software engineering owners through code review
• Nice to have Experience validating, debugging, or prompt-tuning automated code generation tools, along with automated patch validation and differential testing
• Practical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across services