Lead AppSec Engineer - HackerOne & API Security Lead

EPAM Systems Inc; United States; Remote; USD 150,000 - 190,000; Full time

Job summary

EPAM Systems Inc. seeks a Lead Application Security Engineer to drive end-to-end remediation across teams, starting with HackerOne findings and API/GraphQL issues.

You will own intake, triage, remediation tracking, and closure across Cybersecurity, Engineering, Product, and vendors. You will lead daily HackerOne operations, coordinate remediation across multiple engineering groups, and deliver executive dashboards on backlog trends, SLA compliance, and risk reduction, while leveraging GenAI to

Qualifications

• 5+ years in software engineering or application security.
• Strong knowledge of REST APIs, GraphQL, and API security controls.
• Experience with vulnerability remediation processes and bug bounty programs is a plus.

Responsibilities

• Own the daily operational execution of the HackerOne program.
• Run vulnerability intake, triage, validation, assignment, tracking, and closure end to end.
• Lead weekly operating reviews with HackerOne and internal stakeholders.
• Track remediation commitments and reinforce accountability for delivery.
• Manage coordinated disclosure and related communications.
• Reproduce and validate reported vulnerabilities, evaluating exploitability and business impact.
• Use Postman, browser tooling, and security testing tools to verify findings.
• Support vulnerability prioritization based on customer and business risk.
• Coordinate remediation work across multiple engineering organizations.
• Identify service ownership and route findings correctly while maintaining Jira and ServiceNow tracking.
• Escalate critical items and drive resolution for overdue work.
• Deliver executive-ready reporting and dashboards on backlog trends, SLA compliance, remediation progress, and risk reduction.
• Present status and outcomes to cybersecurity and engineering leadership.
• Leverage GenAI and workflow automation to enhance triage, remediation tracking, reporting, and service ownership identification

Skills

REST APIs

GraphQL

OAuth/JWT

OWASP Top 10

Security testing

Postman

Jira

ServiceNow

Stakeholder management

English communication

Tools

Jira

ServiceNow

GenAI automation

Job description

EPAM Systems Inc. seeks a Lead Application Security Engineer to drive end-to-end remediation across teams, starting with HackerOne findings and API/GraphQL issues.

You will own intake, triage, remediation tracking, and closure across Cybersecurity, Engineering, Product, and vendors. You will lead daily HackerOne operations, coordinate remediation across multiple engineering groups, and deliver executive dashboards on backlog trends, SLA compliance, and risk reduction, while leveraging GenAI to