Application Security & Vulnerability Validation Engineer

We are seeking a seasoned Application Security & Vulnerability Validation Engineer to serve as the operational and technical bridge between automated/AI-driven security scanning and remediation systems and product engineering teams.

In this role, you will streamline service threat modeling, eliminate scanner triage noise, build minimal proofs-of-concept (PoCs) to validate exploitability, perform rigorous quality assurance on AI/agent-generated security patches, and partner with software engineers to drive confirmed vulnerabilities to verified production closure.

Responsibilities

• Construct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findings
• Distinguish true, exploitable vulnerabilities from scanner false positives and attach clear, reproducible evidence to issue tickets
• Supervise, review, and validate code patches generated by automated and AI/agentic remediation systems before they are routed to product code owners
• Inspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and unintended functional regressions
• Execute unit, integration, and differential tests to confirm both fix efficacy and build stability (targeting a ≥90% patch acceptance rate by code owners without major revision)
• Review, filter, and prioritize incoming findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24–48 hour turnaround window
• Classify vulnerability severity using standardized scoring rubrics and map valid findings to strict remediation SLAs
• Evaluate standard compliance exception requests against established security policies and escalate ambiguous, disputed, or architectural edge cases to senior security leads
• Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services
• Maintain standardized threat models and service risk classification tags in centralized repositories
• Route verified, test-passing security patches (changelists / pull requests) to designated product engineering owners
• Shepherd fixes through code review, track remediation SLAs, and verify end-to-end deployment to production

Requirements

• 5+ years of hands-on experience in Application Security, Product Security, or Software Engineering with a strong focus on vulnerability validation, secure code review, and test automation
• Proficiency in reading, writing, and debugging code in at least two core languages (C++, Go, Java, or Python), with the ability to set up local test harnesses, mock dependencies, and build minimal PoCs
• Deep understanding of secure coding standards (input validation, boundary checking, safe memory access, concurrency safety) and high attention to detail when reviewing code diffs for regressions, hallucinations, or off-by-one errors
• Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflows
• Understanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks (e.g., STRIDE, PASTA)
• Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate constructively with software engineering owners through code review

Nice to have

• Experience validating, debugging, or prompt-tuning automated code generation tools, along with automated patch validation and differential testing
• Practical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across services

We offer

• We gather like-minded people:
• • Top tech minds driving innovation in AI, cloud and digital platform modernization
  • Supportive team and agile, startup-like culture
  • Hybrid by design mode and opportunity to work remotely within Poland
  • Chance to work abroad for up to 60 days annually
  • Business-driven relocation opportunities
• We provide growth opportunities:
• • Career development programs
  • Thought leadership, mentoring, soft skills and well-being programs
  • Certification (Anthropic, Gemini, GCP, Azure, AWS)
  • English classes
• We cover it all:
• • Stable pay
  • Participation in the Employee Stock Purchase Plan with a 15% discount
  • Benefits package (health insurance, multisport, shopping vouchers)
  • Referral bonuses up to $2,000
  • Offices featuring entertainment and relaxation zones, table tennis and football, free snacks, coffee and more
  • Corporate, social and well-being events
• Please, note:
• • Benefits listed above are available to employees only
  • We are open for working with Contractors. Terms of B2B cooperation agreements are agreed individually
  • We will reach out to selected candidates exclusively

EPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.

Tech stack

• Application Security
• vulnerability validation
• Secure Code Review
• Static analysis
• Dynamic Analysis
• threat modeling
• PoC development
• Exploitability Assessment
• C++
• Go