Application Security Specialist (regular/senior) (She/He/They)

Description

Assess client security maturity against OWASP ASVS, OWASP Top 10, OWASP API Top 10, and CWE Top 25, then turn identified gaps into prioritized remediation roadmaps.

Run threat modelling and secure design reviews with architects and developers across hybrid, distributed, cloud-native, containerized, microservices, event-driven, and monolithic systems. Review code, APIs, Infrastructure as Code, and CI/CD pipelines; help teams remediate findings; and embed security into pipelines, build systems, and artefact repositories.

Manage software supply chain risks involving dependencies, build integrity, SBOMs, and third-party components. Select, deploy, and tune AppSec tools—including SAST, DAST, SCA, and secrets scanning—so that security gates and automated testing are effective across the SSDLC.

Secure AI-enabled systems, including LLM applications, AI agents, and model and data pipelines. Address risks such as prompt injection, data poisoning, model and inference exposure, and unsafe integration; define AI lifecycle controls; use AI-based tooling for code analysis and vulnerability triage; and support responsible-AI governance and compliance.

Create usable secure-coding standards, design guidance, developer AI-assistant guardrails, security champion programs, and hands-on developer training. Present findings and recommendations to audiences ranging from team leads to CISOs.

Work arrangement

The work location may combine remote work, client-site work, and office work depending on project requirements. Some in-person time is expected for collaboration, learning, and relationship building.

Benefits and development

• Work on international cybersecurity transformation programs across banking, manufacturing, healthcare, retail, and public-sector environments.
• Exposure to Secure SDLC, Application Security, Cloud Security, Security Governance, Enterprise Architecture, emerging technologies, and current tooling.
• Opportunity to lead security discussions with technical, operational, and senior stakeholders.
• Technical, soft-skills, language, e-learning, GenAI, and security-certification development opportunities.

Requirements

• Engineering or IT background, with practical experience building, operating, or designing software systems or infrastructure.
• Foundational knowledge of confidentiality, integrity, availability, encryption, hashing, key management, and common misuse patterns.
• Understanding of how software is specified, built, reviewed, tested, released, and maintained.
• Hands-on experience with at least one CI/CD platform: GitHub, GitLab, Azure DevOps, Bitbucket, Jenkins, or equivalent.
• Practical experience with AWS, Azure, or GCP, including core services and security controls.
• Ability to read code and identify SQL injection, XSS, command injection, and CSRF in Java, C#/.NET, JavaScript, Go, Python, or an equivalent language.
• Professional proficiency in English and Polish. English is used for client-facing findings, workshops, and senior-stakeholder presentations; Polish is used in day-to-day team operations.
• Strong communication skills, proactive ownership, adaptability, and commitment to continuous learning.

Seniority

• Regular: approximately 2–5 years of relevant experience; independently deliver defined workstreams such as threat modelling, pipeline and IaC reviews, and findings reporting. Working knowledge of OWASP Top 10 and secure-coding principles is expected.
• Senior: approximately 5+ years of relevant experience; lead workstreams, provide technical direction, and mentor junior colleagues. Demonstrated depth in cloud security, software supply chain, AppSec tooling, secure design and threat modelling, or AI security is expected, along with the breadth to engage across all areas and present to senior stakeholders.

Preferred qualifications

• Practical application-security knowledge: OWASP Top 10, OWASP ASVS, OWASP API Top 10, CWE Top 25, secure coding, vulnerability classes, and exploitation techniques.
• Threat modelling that considers business logic, architecture, and deployment models.
• Authentication, authorization, and session management using OAuth 2.0, OpenID Connect, SAML, SSO, and identity-centric security models.
• Experience running, tuning, or restoring trust in SAST, DAST, and SCA tooling.
• Experience securing CI/CD pipelines, Infrastructure as Code, containers, and software supply chains, including dependency scanning, SBOMs, SLSA, and artefact signing.
• Additional experience with AWS, Azure, or GCP and native security services.
• Experience or strong interest in AI and LLM security, including prompt injection, data poisoning, model exposure, AI-agent abuse, and controls across AI pipelines.
• Experience with AI-powered security tools for code analysis, vulnerability detection, or security automation.
• Governance, risk, and compliance experience for secure and responsible AI use.
• Prior consulting or client-facing experience.
• Security certifications.

What is offered

• Permanent employment contract.
• Individual support from a People Lead, a defined professional-development path, and access to coaching.
• Training in technical, soft, and language skills; e-learning access; GenAI training; and co-financing for courses and certifications.
• Employee Assistance Program with legal, financial, and psychological consultations.
• Employee share purchase plan and potential quarterly dividends for eligible shareholders.
• Paid employee referral program.
• Private medical care and life insurance.
• Access to the Worksmile platform, including a Multisport card option.