Application Security Engineer

Michael Page International (Poland) Sp. z o.o.

Gdańsk (pomorskie)

Podobne oferty pracy

Digital Transformation Project Manager
ManpowerGroup Sp. z o.o.
- Warszawa
- umowa o pracę
Polecana

Wygasa dzisiaj
Payroll Specialist with French (m/k)
ManpowerGroup Sp. z o.o.
- Łódź
- umowa o pracę
- praca hybrydowa
Polecana

Dodana 11 września
Payroll Specialist with Spanish (m/k)
ManpowerGroup Sp. z o.o.
- Łódź
- umowa o pracę
- praca hybrydowa
Polecana

Dodana 11 września

Zakres obowiązków

EU Regulatory Contex

Design, execute and document security activities in alignment with applicable European Union and Polish legal, regulatory, privacy and operational-resilience requirements, including GDPR, NIS2 and DORA where relevant to the business and service scope.
Maintain evidence that is clear, reproducible and audit-ready, while applying data minimization, appropriate access controls and defined retention practices.
Coordinate cross-border work so that testing authorization, handling of personal data, evidence storage and disclosure of findings remain consistent with EU requirements and internal governance.

Security Automation and Integration

Design, implement and maintain automated security checks across source, build, test and delivery workflows using reusable, vendor-portable components.
Integrate static analysis (Semgrep), software composition analysis, dynamic application security testing, API security testing, Infrastructure-as-Code review and container assessment into engineering pipelines (GitHub Actions, Azure DevOps, or equivalent).
Apply AI-assisted security review to support triage, code review, finding correlation, remediation guidance and risk summaries, while keeping outputs explainable, auditable and subject to human validation.
Create secure-by-default templates, reusable controls and self-service capabilities that reduce manual effort and make the preferred secure path the easiest path.
Continuously tune rules, thresholds and workflows to reduce noise, improve signal quality and prevent duplicate findings.

Securing AI-Integrated Applications

Assess AI-integrated application features for prompt injection, insecure output handling, excessive agency, training data leakage and model manipulation, consistent with the OWASP LLM Top 10.
Review agentic and LLM-backed integrations for authorization boundaries, tool and API exposure, and token scoping.
Apply enterprise secure-by-default patterns for AI workloads during design and code review, and feed recurring weaknesses back into standards.
Stay current on the AI threat landscape and translate emerging risks into practical testing and control requirements.

Finding Management and Remediation Enablement

Feed normalized, enriched and deduplicated findings into the enterprise ASPM platform so that application risk is prioritized in a single consolidated view rather than per-tool or per-region.
Maintain regional reporting that shows coverage, exposure, remediation progress, aging and recurring weakness patterns, consistent with enterprise ASPM definitions and severity models.
Partner with engineering teams to reproduce and validate findings, provide practical remediation guidance and confirm effective closure.
Escalate material or systemic risks through the enterprise risk governance process, supporting exception and risk-acceptance decisions with complete, traceable evidence.
Use practical exploitation techniques to validate selected findings and establish realistic exploitability, coordinating with the offensive security team for full-scope testing.

Program and Process Development

Help build a maturing application security process, including standards, operating procedures, service definitions, intake paths, exception handling, documentation and supporting tools, aligned to the enterprise AppSec program.
Work with development, platform, architecture, offensive security, security operations, privacy, risk and compliance teams across countries and cultures.
Define and improve measures for scanning coverage, actionable signal, remediation flow, repeat weaknesses and automation effectiveness.
Identify manual bottlenecks and automate high-volume activities so the team can increase coverage and risk reduction without proportional effort.

Wymagania

Typically 5+ years of relevant hands-on experience in software engineering, application security engineering, DevSecOps, security automation or a closely related discipline.
Strong software engineering fundamentals and hands-on experience developing automation, integrations, scripts or security tooling using Python, PowerShell, JavaScript/TypeScript, Go or similar languages.
Hands-on experience integrating security capabilities into CI/CD and software delivery pipelines, such as GitHub Actions, Azure DevOps, GitLab CI, Jenkins or equivalent platforms.
Practical experience integrating and operating SAST, SCA, DAST, API security, container security and IaC security capabilities.
Strong source-code review skills, with the ability to distinguish exploitable security defects from scanner noise and explain practical remediation to software engineers.
Experience working directly with software engineering, DevOps, platform and architecture teams to embed security controls into development workflows.
Experience using APIs and structured data to automate security workflows, including ingestion, normalization, deduplication, routing and lifecycle management of findings.
Strong understanding of secure software design, common application and infrastructure vulnerability classes, attack paths and risk-based remediation.
Working knowledge of penetration-testing techniques sufficient to reproduce vulnerabilities, validate selected findings and establish realistic exploitability.
Ability to build reusable security controls, templates and self-service capabilities rather than relying primarily on manual security review.
Strong written and verbal English communication, disciplined technical documentation and the ability to work effectively with technical and non-technical stakeholders in a global environment.

Preffered Qualifications

Experience securing AI-integrated application features (prompt injection, agentic abuse, model manipulation) and familiarity with OWASP LLM Top 10, MITRE ATLAS or NIST AI RMF.
Experience using AI/LLM tooling to accelerate code review, triage and remediation guidance at scale.
Experience with ASPM platforms and risk-based vulnerability prioritization.
Experience in financial services or another regulated environment.
Relevant application security, cloud or engineering certifications are beneficial; demonstrated software engineering, automation and security integration experience matters more than certification count.

Oferujemy

Permanent employment contract.
Private healthcare package with Luxmed
Life insurance with Unum
MyBenefit cafeteria platform
Real career growth and learning opportunities within a global organization

Podobne oferty pracy

Payroll Specialist with Italian (m/k)
ManpowerGroup Sp. z o.o.
- Łódź
- umowa o pracę
- praca hybrydowa
Polecana

Dodana 11 września
Payroll Specialist with German (m/k)
ManpowerGroup Sp. z o.o.
- Łódź
- umowa o pracę
- praca hybrydowa
Polecana

Dodana 11 września
Specjalista / Specjalistka ds. automatyzacji procesów (K/M/N)
BZK i Wspólnicy Sp. z.o.o
- Elżbietów
- umowa o pracę
Polecana

Wygasa za 3 dni

Administratorem danych osobowych jest Michael Page Finance & Human Resources 40-007 Katowice Uniwersytecka 13, NIP: 5252345586. Moje dane osobowe przetwarzane są w celu rekrutacji przez Administratora. Wiem, że przysługują mi następujące prawa: prawo żądania dostępu do swoich danych, prawo do ich sprostowania, prawo do usunięcia danych, prawo do ograniczenia przetwarzania, prawo do wniesienia sprzeciwu oraz prawo do przenoszenia danych. Więcej informacji na temat przetwarzania danych osobowych, znajduje się w Polityce Prywatności Administratora.
Wyrażam zgodę na przetwarzanie moich danych osobowych przez Michael Page Finance & Human Resources 40-007 Katowice Uniwersytecka 13, NIP: 5252345586 zawartych w załączonych dokumentach aplikacyjnych (w tym wizerunku), na potrzeby bieżącej rekrutacji. Zgoda jest dobrowolna i może być w każdym czasie wycofana. Dodatkowo wyrażam zgodę na przetwarzanie moich danych osobowych zawartych w załączonych dokumentach aplikacyjnych (w tym wizerunku), na potrzeby przyszłych rekrutacji przez okres 12 miesięcy. Zgoda jest dobrowolna i może być w każdym czasie wycofana.