Senior Application Security Engineer

EPAM is seeking a skilled Senior Application Security Engineer to help our clients strengthen their security posture. You will collaborate with a range of security and non-security teams to establish secure coding standards, perform in-depth code reviews, embed SAST/DAST tools within the CI/CD pipeline, and support threat modeling throughout the software development lifecycle.

Responsibilities

Perform security assessments, threat modeling, and evaluate penetration testing outcomes for applications Work alongside developers and other stakeholders to fix identified security weaknesses Build and deploy automated security testing tools and workflows to detect vulnerabilities Embed security tools, standards, and processes within the secure software development lifecycle (SSDLC) Keep current with emerging security threats and update scanning rules accordingly Provide training and guidance to developers on security best practices and awareness Shape and drive the security strategy and roadmap for application development Fine-tune and adapt SAST processes to meet application security needs Gain thorough knowledge of SAST methodologies and champion their purpose within the development lifecycle Partner with developers to smoothly incorporate SAST tools into their workflows and CI/CD pipelines Requirements Minimum 5 years of experience in Application Security Solid background with Checkmarx CxSAST or similar SAST tools Skilled in CxQL for creating and adjusting scanning rules Strong grasp of SAST and its function in secure software development Experience with GitHub and embedding security scans into CI/CD pipelines Sharp analytical abilities to interpret scan outcomes and enhance scan precision Effective communication skills for close collaboration with development teams and stakeholders Comprehensive understanding of Dev.

Sec. Ops principles, focusing on security integration across all development stages Fluent in English communication at a B2+ level Nice to have Familiarity with Python, Go, or other scripting languages and automation tools General knowledge of Cloud Platforms Experience with CI/CD tools such as Jenkins, GitLab CI/CD, or Azure DevOps Background in containerization and orchestration technologies like Docker and Kubernetes Knowledge of Sec.

Ops tools and practices, covering security monitoring, incident response, and threat modeling Understanding of Infrastructure as Code tools like Terraform or Ansible Experience with security monitoring and logging tools like ELK Stack or Prometheus