Back to SearchApplication Security & Vulnerability Validation Engineer
Remote in Poland
Security.Engineering& 3 others
Looking for something else?
Find a vacancy that works for you. Send us your CV to receive a personalized offer.
Find me a job
We are seeking a seasoned Application Security & Vulnerability Validation Engineer to serve as the operational and technical bridge between automated/AI-driven security scanning and remediation systems and product engineering teams.
In this role, you will streamline service threat modeling, eliminate scanner triage noise, build minimal proofs-of-concept (PoCs) to validate exploitability, perform rigorous quality assurance on AI/agent-generated security patches, and partner with software engineers to drive confirmed vulnerabilities to verified production closure.
Responsibilities
- Construct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findings
- Distinguish true, exploitable vulnerabilities from scanner false positives and attach clear, reproducible evidence to issue tickets
- Supervise, review, and validate code patches generated by automated and AI/agentic remediation systems before they are routed to product code owners
- Inspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and unintended functional regressions
- Execute unit, integration, and differential tests to confirm both fix efficacy and build stability (targeting a ≥90% patch acceptance rate by code owners without major revision)
- Review, filter, and prioritize incoming findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24–48 hour turnaround window
- Classify vulnerability severity using standardized scoring rubrics and map valid findings to strict remediation SLAs
- Evaluate standard compliance exception requests against established security policies and escalate ambiguous, disputed, or architectural edge cases to senior security leads
- Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services
- Maintain standardized threat models and service risk classification tags in centralized repositories
- Route verified, test-passing security patches (changelists / pull requests) to designated product engineering owners
- Shepherd fixes through code review, track remediation SLAs, and verify end-to-end deployment to production
Requirements
- 5+ years of hands-on experience in Application Security, Product Security, or Software Engineering with a strong focus on vulnerability validation, secure code review, and test automation
- Proficiency in reading, writing, and debugging code in at least two core languages (C++, Go, Java, or Python), with the ability to set up local test harnesses, mock dependencies, and build minimal PoCs
- Deep understanding of secure coding standards (input validation, boundary checking, safe memory access, concurrency safety) and high attention to detail when reviewing code diffs for regressions, hallucinations, or off-by-one errors
- Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflows
- Understanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks (e.g., STRIDE, PASTA)
- Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate constructively with software engineering owners through code review
Nice to have
- Experience validating, debugging, or prompt-tuning automated code generation tools, along with automated patch validation and differential testing
- Practical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across services