[Hiring] Senior Application Security Engineer @EPAM Systems

Role Description

We are seeking a Senior Application Security Engineer to own and drive application security vulnerability remediation programs, with an initial focus on:

• HackerOne bug bounty findings
• API security vulnerabilities
• GraphQL authorization issues
• Cross-functional remediation tracking

This role serves as the operational owner of the vulnerability remediation lifecycle, coordinating across Cybersecurity, Engineering, Product, and external vendors to ensure timely identification, validation, assignment, remediation, and closure of security findings.

Responsibilities

• Own day-to-day management of the HackerOne program
• Manage vulnerability intake, triage, validation, routing, tracking, and closure
• Coordinate weekly operating reviews with HackerOne and internal stakeholders
• Track remediation commitments and drive accountability
• Manage disclosure and communication processes
• Reproduce and validate reported vulnerabilities, assessing exploitability and business impact
• Utilize Postman, browser tooling, and security testing tools to validate findings
• Support vulnerability prioritization based on customer and business risk
• Coordinate remediation efforts across multiple engineering organizations
• Identify service ownership and route findings appropriately, maintaining Jira and ServiceNow tracking
• Escalate critical and overdue items
• Produce executive-level reporting and dashboards, tracking backlog trends, SLA compliance, remediation progress, and risk reduction
• Present status updates to cybersecurity and engineering leadership
• Leverage GenAI and workflow automation to improve triage, remediation tracking, reporting, and service ownership identification

Qualifications

• 3+ years of experience in Software Engineering or Application Security
• Understanding of REST APIs, GraphQL, and Authentication & Authorization mechanisms
• Knowledge of OAuth, JWT, OWASP Top 10, and API Security Top 10
• Experience reproducing security findings
• Proficiency in Postman
• Experience with Jira and ServiceNow
• Strong stakeholder management skills
• English proficiency at B2 level or higher

Requirements

• Background in HackerOne or Bug Bounty programs (nice to have)
• Experience in AppSec and penetration testing (nice to have)
• Full-stack software development background (nice to have)
• Familiarity with Burp Suite (nice to have)
• Experience with GenAI automation (nice to have)