{"id":2912888,"url":"https://alion.io/job/spoton-senior-application-security-engineer","title":"Senior Application Security Engineer","company":{"id":1761,"name":"SpotOn","domain":"spoton.com","url":"https://alion.io/company/spoton","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":88,"open_postings":8,"ghost_share":0,"stale_share":0.5,"repost_share":0,"time_to_fill_p50_days":23,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Kraków, Poland"],"countries":["PL"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":18900,"max":23700,"currency":"PLN","period":"month","gross":null,"usd_annual":73236},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"DefectDojo","optional":false},{"name":"PCI DSS","optional":false},{"name":"STRIDE","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-10-20T09:41:31Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-10-23T11:35:34Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"About SpotOn\nWe’re not just building restaurant tech, we’re giving independent restaurants the tools to compete and win. From our award-winning point-of-sale to AI-powered profit tools, everything we do helps operators boost profit, work smarter, and keep their best people. And every solution is backed by real humans who actually give a sh*t about helping restaurants succeed.\nNamed the #1 Restaurant POS by G2 (Summer 2026), based on ratings from real users\n\nRated the top-rated point-of-sale (POS) for restaurants, bars, retail, and small businesses by Capterra users\n\nAwarded Great Places to Work and Built In’s Best Workplaces for multiple years running\n\nWe move fast, care hard, and fight for independent restaurant operators to do what they love, and love doing it. If you’re looking to make an impact with heart and hustle, SpotOn is the place for you.\nAbout the Role:\nSpotOn's Information Security team is hiring a Senior Application Security Engineer to own and mature our application security program. This role maintains the security scanning pipeline (SAST, DAST, dependency, and secrets detection), leads third-party penetration testing engagements, and drives forward newer initiatives like AI/ML pen testing and threat modeling.\nThis person will own program measurement and reporting, building the metrics that demonstrate how our AppSec initiatives are performing and translating that into executive-ready reporting for our Head of Security. This includes defining the right metrics, tracking them consistently, and presenting program trajectory in a way leadership can act on.\nThis is a fully qualified position: you're expected to work independently within established security practices, exercise judgment on findings triage and prioritization, and be a credible technical resource that developers actively want to loop in.\nOn a daily basis you will:\nProgram Measurement & Executive Reporting (priority focus)\nDefine and own the metrics framework for the AppSec program: what gets measured, why it matters, and how it ties to risk reduction (examples: mean time to remediate by severity, finding density trends over time, scan coverage across the repo portfolio, pen test finding recurrence rate, PR security review adherence).\n\nEstablish baselines for each metric to track program trajectory over time.\n\nBuild recurring reporting (monthly/quarterly cadence) that translates raw data into a narrative leadership can act on.\n\nPrepare materials for the Head of Security to present to Executive leadership, showing program trajectory and where initiatives are moving the needle.\n\nVulnerability Management & Tooling\nOwn and maintain the AppSec scanning stack: SAST, DAST, dependency (SCA), and secrets detection across the repo portfolio.\n\nEnsure findings from all scanners display accurately in inventory system for engineering visibility.\n\nTune scanner configurations to reduce noise and false positives, and keep detection coverage current as new repos and services onboard.\n\nCode Review & PR Security Gate\nEstablish and maintain a consistent PR review practice for security-relevant changes.\n\nTrack and report on adherence to this process as one of the program's core metrics.\n\nPenetration Testing\nLead and coordinate application penetration testing engagements with our third-party vendor from scoping through remediation tracking.\n\nServe as the primary point of contact for developers who have questions about pen test findings.\n\nTrack pen test outcomes over successive engagements as a measure of whether earlier findings are staying fixed.\n\nStrategic Initiatives\nDesign and implement new AppSec initiatives, including AI-specific penetration testing and formal threat modeling practices.\n\nDefine success metrics for each new initiative before it launches, so its impact can be measured rather than assumed.\n\nContainer & Supply Chain Security\nImplement and maintain image trust enforcement.\n\nPartner with Infrastructure/DevOps to ensure image signing and trust policies don't create unnecessary friction in the deployment pipeline.\n\nWhat skill are we looking for?\nBachelor's degree in Computer Science, Information Security, or related field (or equivalent practical experience).\n\n5+ years of experience in application security, secure code review, or a closely related engineering/security discipline.\n\nAvailability to work in a hybrid work model.\n\nDemonstrated experience building or owning security metrics and reporting, ideally with exposure to communicating program health to non-technical or executive audiences.\n\nHands-on experience with SAST, DAST, and SCA tooling, and with vulnerability management platforms such as DefectDojo.\n\nDemonstrated experience coordinating or directly performing penetration testing, including working with external testing vendors.\n\nFamiliarity with container security concepts and admission control (Wiz or equivalent).\n\nWorking knowledge of AWS security services and cloud-native application architectures.\n\nAbility to work with minimal day-to-day direction, exercising independent judgment within established security practices.\n\nStrong written and verbal communication skills, with the ability to translate technical findings into business-relevant narrative for leadership.\n\nPerfect candidate also has:\nExperience presenting security metrics or dashboards to executive stakeholders.\n\nExperience with threat modeling frameworks (STRIDE, PASTA, or similar).\n\nExposure to AI/ML security testing or red-teaming.\n\nPCI DSS familiarity.\n\nHere’s a bit about what we have to offer:\nCompetitive pay: 18 900 - 23 700 PLN net on B2B.\n\nTraining budget 3500 PLN gross per year.\n\nAccess to e-learning platforms (O’Reilly).\n\nFully paid private healthcare in LuxMed.\n\nAccess to the Worksmile platform with a monthly top-up.\n\nSubsidized access to breakfast and lunch through the vending machine in Kraków office, and lunches in Gdańsk office once a week.\n\nGroup English classes with a native speaker.\n\nNew Macbook Pro, 4K monitors or whatever tools you need.\n\nFlexible working hours.\n\nNew, modern, bright and comfortable office space in the city centre.\n\nAccess to the company’s library.\n\nGreat working atmosphere.\n\nChill out room with a PlayStation and games.\n\nFree snacks and beverages in a kitchen.\n\nCompany parties and social activities.\n\nEmployee referral program.\n\nRelocation Package within Poland.\n\nThe controller of your personal data included in your job offer and others collected during the recruitment process is SpotOn Poland spółka z ograniczoną odpowiedzialnością with its registered office in Kraków, Aleja 29 listopada 20, 31-401 Kraków, e-mail address: \n. We will process your personal data for the purpose of current or, if you voluntarily agree, also future recruitment processes. More information about how we proccess your data, including the basis for processing and your rights in relation to the processing, can be found on our website: https://pl.spoton.com/privacy-and-cookies-policy.\nAdministratorem podanych danych osobowych, w tym danych zawartych w dokumentach aplikacyjnych i zebranych w toku procesu rekrutacji, jest SpotOn Poland Sp. z o.o. z siedzibą w Krakowie (ul. Aleja 29 listopada 20, 31-401 Kraków; adres e-mail do kontaktu: \n. Dane osobowe będą przetwarzane w celu realizacji obecnych lub - jeżeli wyrazisz na to dobrowolną zgodę - także przyszłych procesów rekrutacji. Więcej informacji o tym, jak przetwarzamy Twoje dane, w tym także informacje o podstawach prawnych przetwarzania oraz o prawach przysługujących Ci w związku z przetwarzaniem danych, znajdziesz na stronie: \nhttps://pl.spoton.com/privacy-and-cookies-policy.\nWe will never ask candidates to pay fees, purchase equipment, or share sensitive personal or financial information during the hiring process. All legitimate communication from our recruiting team will come from an official company email address (@spoton.com). If something seems suspicious, please contact us at .\nSpotOn is an equal employment opportunity employer. Qualified candidates are considered for employment without regard to race, religion, gender, gender identity, sexual orientation, national origin, age, military or veteran status, disability, or any other characteristic protected by applicable law.\nFor U.S. based roles, work authorization in the U.S. is required. Visa sponsorship is not available for this role.\nSpotOn is an E-Verify company.","description_format":"text","description_chars":8439,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Apple Macbook","Flexible schedule","Hybrid work"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Poland","iso":"PL","kind":"country"}],"hiring_excludes":[],"relocation_offered":true,"industries":["Application Security","POS Systems","Payment Processing & Gateways"],"lifecycle":[{"event":"open","at":"2026-10-20T10:06:25Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":23,"reasons":["conf:3","velocity","win:early"],"computed_at":"2026-10-23T05:54:15Z"},"pay":{"stated_usd_annual":73236,"is_top_pay":false},"html_url":"https://alion.io/job/spoton-senior-application-security-engineer","json_url":"https://alion.io/job/spoton-senior-application-security-engineer.json","meta":{"generated_at":"2026-10-23T16:20:20Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":24785,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1761},"rest":"https://alion.io/mcp/rest/get_company?id=1761"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fspoton-senior-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fspoton-senior-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fspoton-senior-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/spoton-senior-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fspoton-senior-application-security-engineer"}]}