Application Security Engineer

EU Regulatory Contex

• Design, execute and document security activities in alignment with applicable European Union and Polish legal, regulatory, privacy and operational-resilience requirements, including GDPR, NIS2 and DORA where relevant to the business and service scope.
• Maintain evidence that is clear, reproducible and audit-ready, while applying data minimization, appropriate access controls and defined retention practices.
• Coordinate cross-border work so that testing authorization, handling of personal data, evidence storage and disclosure of findings remain consistent with EU requirements and internal governance.

Security Automation and Integration

• Design, implement and maintain automated security checks across source, build, test and delivery workflows using reusable, vendor-portable components.
• Integrate static analysis (Semgrep), software composition analysis, dynamic application security testing, API security testing, Infrastructure-as-Code review and container assessment into engineering pipelines (GitHub Actions, Azure DevOps, or equivalent).
• Apply AI-assisted security review to support triage, code review, finding correlation, remediation guidance and risk summaries, while keeping outputs explainable, auditable and subject to human validation.
• Create secure-by-default templates, reusable controls and self-service capabilities that reduce manual effort and make the preferred secure path the easiest path.
• Continuously tune rules, thresholds and workflows to reduce noise, improve signal quality and prevent duplicate findings.

Securing AI-Integrated Applications

• Assess AI-integrated application features for prompt injection, insecure output handling, excessive agency, training data leakage and model manipulation, consistent with the OWASP LLM Top 10.
• Review agentic and LLM-backed integrations for authorization boundaries, tool and API exposure, and token scoping.
• Apply enterprise secure-by-default patterns for AI workloads during design and code review, and feed recurring weaknesses back into standards.
• Stay current on the AI threat landscape and translate emerging risks into practical testing and control requirements.

Finding Management and Remediation Enablement

• Feed normalized, enriched and deduplicated findings into the enterprise ASPM platform so that application risk is prioritized in a single consolidated view rather than per-tool or per-region.
• Maintain regional reporting that shows coverage, exposure, remediation progress, aging and recurring weakness patterns, consistent with enterprise ASPM definitions and severity models.
• Partner with engineering teams to reproduce and validate findings, provide practical remediation guidance and confirm effective closure.
• Escalate material or systemic risks through the enterprise risk governance process, supporting exception and risk-acceptance decisions with complete, traceable evidence.
• Use practical exploitation techniques to validate selected findings and establish realistic exploitability, coordinating with the offensive security team for full-scope testing.

Program and Process Development

• Help build a maturing application security process, including standards, operating procedures, service definitions, intake paths, exception handling, documentation and supporting tools, aligned to the enterprise AppSec program.
• Work with development, platform, architecture, offensive security, security operations, privacy, risk and compliance teams across countries and cultures.
• Define and improve measures for scanning coverage, actionable signal, remediation flow, repeat weaknesses and automation effectiveness.
• Identify manual bottlenecks and automate high-volume activities so the team can increase coverage and risk reduction without proportional effort.