Application Security & Vulnerability Validation Engineer
New
E
EPAM SystemsApplication security
Opportunity to work remotely within PolandFull-TimeSenior
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Languages
- English B2
- Experience
- 5+ years of hands-on experience
- Required Skills
- PythonJavaC++Go
Requirements
- Have 5+ years of hands-on experience in Application Security, Product Security, or Software Engineering focused on vulnerability validation, secure code review, and test automation.
- Read, write, and debug code in at least two of C++, Go, Java, or Python.
- Be able to set up local test harnesses, mock dependencies, and build minimal proofs of concept.
- Understand secure coding practices, including input validation, boundary checking, safe memory access, and concurrency safety.
- Know common vulnerability classifications, including CWE, CVE, and OWASP Top 10, as well as vulnerability scoring and SLA-driven remediation workflows.
- Understand architectural trust boundaries, data flows, and attack surfaces.
- Know structured threat modeling frameworks such as STRIDE or PASTA.
- Communicate reproduction steps and severity classifications clearly and collaborate with software engineering owners through code review.
- Nice to have: experience validating or debugging automated code-generation tools and automated patch validation.
- Nice to have: practical experience with fuzz testing, unit and integration test frameworks, sandbox execution, and debugging runtime or logic errors.
Responsibilities
- Construct local test environments, dependency mocks, and reproduction harnesses to validate security findings.
- Distinguish exploitable vulnerabilities from false positives and attach reproducible evidence to issue tickets.
- Review and validate patches generated by automated remediation systems before routing them to product code owners.
- Inspect code diffs for logic flaws, memory safety issues, off-by-one errors, and functional regressions.
- Run unit, integration, and differential tests to confirm fix efficacy and build stability.
- Review, filter, and prioritize findings from static and dynamic scanning tools.
- Classify vulnerability severity and map valid findings to remediation SLAs.
- Document service entry points, trust boundaries, attack surfaces, and data flows; maintain threat models and risk tags.
- Shepherd fixes through code review, track remediation SLAs, and verify production deployment.
View Full Description & ApplyYou'll be redirected to the employer's site
