Senior AppSec Engineer: Vulnerability Remediation Lead

EPAM Systems, Inc.; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Healthcare benefits

Paid time off

LinkedIn Learning access

Global career opportunities

Employee resource groups

Volunteer opportunities

Job summary

EPAM Systems, Inc. seeks a Senior Application Security Engineer to own the vulnerability remediation lifecycle, focusing on HackerOne findings, API security, and GraphQL authorization.

You will coordinate across Cybersecurity, Engineering, Product, and external vendors to ensure timely triage, assignment, remediation, and closure of security findings. You will reproduce and validate vulnerabilities, assess exploitability, and drive remediation with Postman and security tooling.

Qualifications

• 3+ years of experience in software engineering or application security.
• Knowledge of REST APIs, GraphQL, OAuth/JWT and API Security Top 10.
• Experience reproducing security findings.
• Proficiency in Postman.
• Familiarity with Jira and ServiceNow.
• English proficiency at B2 level or higher.
• Nice to have HackerOne/Bug Bounty background.
• Full-stack software development background.
• Familiarity with GenAI automation.

Responsibilities

• Own day-to-day management of the HackerOne program.
• Manage vulnerability intake, triage, validation, routing, tracking, and closure.
• Coordinate weekly operating reviews with HackerOne and internal stakeholders.
• Track remediation commitments and drive accountability.
• Manage disclosure and communication processes.
• Reproduce and validate reported vulnerabilities, assessing exploitability and business impact.
• Utilize Postman, browser tooling, and security testing tools to validate findings.
• Support vulnerability prioritization based on customer and business risk.
• Coordinate remediation efforts across multiple engineering organizations.
• Identify service ownership and route findings appropriately, maintaining Jira and ServiceNow tracking.
• Escalate critical and overdue items.
• Produce executive-level reporting and dashboards, tracking backlog trends, SLA compliance, remediation progress, and risk reduction.
• Present status updates to cybersecurity and engineering leadership.
• Leverage GenAI and workflow automation to improve triage, remediation tracking, reporting, and service ownership identification.

Skills

REST APIs

GraphQL

OAuth/JWT

OWASP Top 10

API Security Top 10

Postman

Jira

ServiceNow

GenAI automation

Stakeholder management

Burp Suite

Full-stack development

Tools

Burp Suite

Jira

ServiceNow

Postman

Job description

EPAM Systems, Inc. seeks a Senior Application Security Engineer to own the vulnerability remediation lifecycle, focusing on HackerOne findings, API security, and GraphQL authorization.

You will coordinate across Cybersecurity, Engineering, Product, and external vendors to ensure timely triage, assignment, remediation, and closure of security findings. You will reproduce and validate vulnerabilities, assess exploitability, and drive remediation with Postman and security tooling.