Senior Application Security Engineer

Job Description

EPAM is seeking a skilled Senior Application Security Engineer to help our clients strengthen their security posture.

You will collaborate with a range of security and non-security teams to establish secure coding standards, perform in-depth code reviews, embed SAST/DAST tools within the CI/CD pipeline, and support threat modeling throughout the software development lifecycle.

_This position offers hybrid setup with the flexibility to work from any location in Lithuania, whether it's your home or our dynamic offices in Vilnius and Kaunas._

• Perform security assessments, threat modeling, and evaluate penetration testing outcomes for applications
• Work alongside developers and other stakeholders to fix identified security weaknesses
• Build and deploy automated security testing tools and workflows to detect vulnerabilities
• Embed security tools, standards, and processes within the secure software development lifecycle (SSDLC)
• Keep current with emerging security threats and update scanning rules accordingly
• Provide training and guidance to developers on security best practices and awareness
• Shape and drive the security strategy and roadmap for application development
• Fine-tune and adapt SAST processes to meet application security needs
• Gain thorough knowledge of SAST methodologies and champion their purpose within the development lifecycle
• Partner with developers to smoothly incorporate SAST tools into their workflows and CI/CD pipelines

Requirements

• Minimum 5 years of experience in Application Security
• Solid background with Checkmarx CxSAST or similar SAST tools
• Skilled in CxQL for creating and adjusting scanning rules
• Strong grasp of SAST and its function in secure software development
• Experience with GitHub and embedding security scans into CI/CD pipelines
• Sharp analytical abilities to interpret scan outcomes and enhance scan precision
• Effective communication skills for close collaboration with development teams and stakeholders
• Comprehensive understanding of DevSecOps principles, focusing on security integration across all development stages
• Fluent in English communication at a B2+ level

Nice to have

• Familiarity with Python, Go, or other scripting languages and automation tools
• General knowledge of Cloud Platforms
• Experience with CI/CD tools such as Jenkins, GitLab CI/CD, or Azure DevOps
• Background in containerization and orchestration technologies like Docker and Kubernetes
• Knowledge of SecOps tools and practices, covering security monitoring, incident response, and threat modeling
• Understanding of Infrastructure as Code tools like Terraform or Ansible
• Experience with security monitoring and logging tools like ELK Stack or Prometheus

Company offers

• Engineering Heritage: Best-in-class experts sharing a culture of engineering excellence and tackling complex engineering challenges for over 30 years
• Advanced Tech Stack: Innovative projects where you can apply or enhance your expertise in Cloud, Data, AI, and other emerging technologies
• World-Class Clients: Work closely with 340+ of the Forbes Global 2000 on creating disruptive solutions that make a global impact
• Professional Growth: Exceptional support for career development with comprehensive resources for upskilling or reskilling in pioneering practices
• GenAI Community: Strong AI competencies with 600+ experts across 55+ locations driving GenAI-enabled transformation journeys
• Entrepreneurial Culture: If you're passionate and dedicated to improving business transformation, we provide the support you need to bring your ideas to life
• Hybrid Setup: The flexibility to work from any location in Lithuania, whether it's your home or our dynamic offices in Vilnius and Kaunas
• Other Benefits: Additional vacation and trust days, private health insurance, Employee Stock Purchase Plan and more