Senior Application Security Engineer (AI models)

EPAM Systems Inc; United States; Remote; USD 120,000 - 170,000; Full time

Job summary

EPAM Systems Inc. seeks a Senior Application Security Engineer to standardize Security Software Development Lifecycle practices and mitigate vulnerabilities across client projects.

You will collaborate with developers to deliver secure code under tight deadlines and lead security tooling, QA, and threat modeling efforts while expanding coverage in Azure and AWS environments.

Qualifications

• Degree in Computer Science or Cyber Security or equivalent.
• Experience with application security across SDLC.

Responsibilities

• Collaborate with software and security engineers to design, maintain, and build product security tools and services.
• Serve as the technical point of contact for product teams regarding CI/CD automation and Product Application Sec Ops.
• Leverage AI models to assess application code for weaknesses, misconfigurations, and vulnerabilities.
• Build and automate scripts enabling developers to consume security services.
• Own security product QA and testing activities.
• Run software composition analysis (SCA) tools.
• Explain penetration testing findings and guide risk mitigation.
• Improve operations of SAST, DAST and IaC security tools.
• Enhance Web Application Firewalls (WAF) and IDS operations.
• Expand security coverage in Azure and AWS environments.

Skills

OWASP & secure design

Threat modeling

Secure coding

Analytical skills

English communication

Presentation skills

Risk triage

Education

Degree in Computer Science or Cyber Security

Cybersecurity certifications (CISSP/CSSLP/CEH/OSCP)

Tools

Azure DevOps

GitHub

Copilot

Codex

Cyber Harness

Job description

We are seeking a Senior Application Security Engineer to define consistent Security Software Development Lifecycle practices across all client technology projects. In this role, you will ensure application security vulnerabilities are mitigated to tolerable levels throughout the planning and delivery cycles. The ideal candidate brings strong application security knowledge, web application development experience, and team leadership skills, along with a solid understanding of OWASP, CWE25, Data Protection, Access Management, software vulnerabilities, secure design best practices, and threat modeling. You will collaborate with developers to produce secure code under tight deadlines in a dynamic environment.

Responsibilities

• Collaborate as part of a team of software and security engineers to design, maintain, and build product security tools and services
• Serve as the technical point of contact for product teams regarding CI/CD automation and Product Application Sec Ops
• Leverage approved AI models and Cyber Harness to assess application code for business logic weaknesses, misconfigurations, and vulnerabilities
• Build and automate scripts that enable developers to easily consume security services delivered by the Sec Engineering and Automation team
• Own security product QA and testing activities
• Run software composition analysis (SCA) tools
• Interpret and explain penetration testing findings to the software engineering team, assisting them with triage and risk mitigation guidance
• Articulate business risk when assessing software vulnerabilities
• Continuously improve the operations of SAST, DAST, and IaC security tools
• Enhance the operations of Web Application Firewalls (WAF) and IDS
• Expand security coverage and tooling in cloud environments such as Microsoft Azure and AWS

Requirements

• Degree in Computer Science or Cyber Security 3+ years of experience in Application Security with a strong application development background
• Hands-on experience with Azure DevOps
• Prior experience using AI models and Cyber Harness to support security evaluation of applications and software code
• Familiarity with GitHub, Copilot, and Codex
• Knowledge of OWASP Top 10 for Agentic AI, AI skills development, and security triage
• Proficiency in coding with Python, JavaScript, C#, or PowerShell
• Deep understanding of OWASP, CWE25, Data Protection, Access Management, software vulnerabilities, secure design best practices, and threat modeling
• Excellent analytical skills with strong attention to detail
• CISSP, CSSLP, CEH, OSCP, or similar certification
• Presentation skills with the ability to communicate complex solutions to less technical audiences
• Excellent command of written and spoken English (B2+ level)
• Nice to have Prior experience working in a large organization or within Financial Services Exposure to secure SDLC program definition across enterprise technology projects