Spoton
Senior Application Security Engineer
Kraków, Lesser Poland Voivodeship, Poland. Posted 25 days ago
The role
The Senior Application Security Engineer will own and mature the application security program. This includes maintaining the security scanning pipeline, leading third-party penetration testing, and driving initiatives like AI/ML pen testing and threat modeling.
What you will do
- Define and own the metrics framework for the AppSec program
- Establish baselines for each metric to track program trajectory
- Build recurring monthly and quarterly reporting for leadership
- Prepare materials for the Head of Security to present to Executive leadership
- Own and maintain the AppSec scanning stack including SAST, DAST, and SCA
- Tune scanner configurations to reduce noise and false positives
- Establish and maintain a consistent PR review practice for security-relevant changes
- Lead and coordinate application penetration testing engagements with third-party vendors
- Design and implement new AppSec initiatives like AI-specific penetration testing and threat modeling
- Implement and maintain image trust enforcement
Required qualifications
- Bachelor's degree in Computer Science, Information Security, or related field (or equivalent practical experience)
- 5+ years of experience in application security, secure code review, or a closely related engineering/security discipline
- Availability to work in a hybrid work model
- Demonstrated experience building or owning security metrics and reporting
- Hands-on experience with SAST, DAST, and SCA tooling
- Experience with vulnerability management platforms such as DefectDojo
- Demonstrated experience coordinating or directly performing penetration testing
- Familiarity with container security concepts and admission control (Wiz or equivalent)
- Working knowledge of AWS security services and cloud-native application architectures
- Ability to work with minimal day-to-day direction
Nice to have
- Experience presenting security metrics or dashboards to executive stakeholders
- Experience with threat modeling frameworks (STRIDE, PASTA, or similar)
- Exposure to AI/ML security testing or red-teaming
- PCI DSS familiarity
Benefits
- Training budget 3500 PLN gross per year
- Access to e-learning platforms (O’Reilly)
- Fully paid private healthcare in LuxMed
- Access to the Worksmile platform with a monthly top-up
- Subsidized access to breakfast and lunch through the vending machine in Kraków office, and lunches in Gdańsk office once a week
- Group English classes with a native speaker
- New Macbook Pro, 4K monitors or whatever tools you need
- Flexible working hours
- New, modern, bright and comfortable office space in the city centre
- Access to the company’s library
- Great working atmosphere
- Chill out room with a PlayStation and games
About the company
SpotOn builds restaurant tech, including point-of-sale and AI-powered profit tools, to help independent restaurants compete. The company has been awarded Great Places to Work and Built In’s Best Workplaces.