AppSec Vulnerability Validation Engineer: AI Patch Vetting

EPAM Systems Inc; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

EPAM Systems Inc. is seeking a seasoned Application Security & Vulnerability Validation Engineer to bridge automated security scanning with product engineering. You will streamline threat modeling, reduce scanner noise, and validate AI-generated patches before they reach code owners.

You will also build PoCs to verify exploitability, review patches for correctness, and ensure end-to-end remediation with production deployment. Strong code literacy and security-domain expertise are essential.

Qualifications

• 5+ years in Application Security, Product Security, or Software Engineering focusing on vulnerability validation.
• Ability to read, write, and debug code in two languages (C++, Go, Java, or Python).
• Familiarity with CWE, CVE, OWASP Top 10 and vulnerability scoring matrices.
• Experience with threat modeling frameworks (STRIDE, PASTA) and remediation workflows.
• Strong written and verbal communication for cross-functional collaboration.

Responsibilities

• Construct test environments and reproduction harnesses to validate findings.
• Differentiate true vulnerabilities from false positives with reproducible evidence.
• Validate code patches produced by automated/AI remediation systems.
• Inspect code diffs for memory safety issues, regressions, or hallucinations.
• Execute unit/integration tests to ensure fix efficacy and stability.
• Prioritize findings from SAST and dynamic scanners within tight SLAs.
• Document entry points, trust boundaries, and data flows for high‑risk services.
• Route patches to product owners and track remediation through deployment.
• Collaborate with engineers to close vulnerabilities in production.

Skills

Security vulnerability validation

Secure code review

Test automation

PoCs

Threat modeling

Job description

EPAM Systems Inc. is seeking a seasoned Application Security & Vulnerability Validation Engineer to bridge automated security scanning with product engineering. You will streamline threat modeling, reduce scanner noise, and validate AI-generated patches before they reach code owners.

You will also build PoCs to verify exploitability, review patches for correctness, and ensure end-to-end remediation with production deployment. Strong code literacy and security-domain expertise are essential.