Senior AppSec Engineer for AI Cloud Platform

Nebius Group; United States; Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Competitive compensation

Career growth

Flexible work

International teams

Job summary

Nebius is seeking a Senior/Staff Application Security Engineer to safeguard our software products across Compute, VPC, and managed services. You will drive secure coding practices and threat modeling, and collaborate with engineering teams to embed security into the SDLC.

The role involves building ASPM at scale, automating SAST/SCA in CI/CD, and maintaining secure guidelines. A strong background in OWASP, hands-on testing, and knowledge of SAML/OIDC are essential for success.

Qualifications

• 6+ years of experience in application security.
• Experience with secure coding practices in Python, Go, Java, or JavaScript.
• Hands-on security testing with Burp Suite, ZAP, Semgrep.
• Understanding of authentication protocols like SAML or OIDC.
• Experience in threat-modeling sessions.

Responsibilities

• Build and maintain Application Security Posture Management (ASPM) at the Company scale.
• Automate and support SAST, SCA tools as part of CI/CD pipelines.
• Improve SAST, secrets detection rules and reduce false positives.
• Identify, analyze, and remediate application security vulnerabilities.
• Collaborate with development teams to integrate security into the SDLC.
• Develop and maintain secure coding guidelines for development teams.
• Conduct threat modeling and risk assessments for new and existing apps.
• Provide tools that facilitate security work like threat modelling and detection.
• Stay updated on threats and mitigations; serve as security SME.

Skills

OWASP Top 10

Threat modeling

Secure coding

Python

Go

Java

JavaScript

Burp Suite

ZAP

Semgrep

Tools

Burp Suite

ZAP

Semgrep

Job description

Nebius is seeking a Senior/Staff Application Security Engineer to safeguard our software products across Compute, VPC, and managed services. You will drive secure coding practices and threat modeling, and collaborate with engineering teams to embed security into the SDLC.

The role involves building ASPM at scale, automating SAST/SCA in CI/CD, and maintaining secure guidelines. A strong background in OWASP, hands-on testing, and knowledge of SAML/OIDC are essential for success.