{"id":103410,"url":"https://alion.io/job/xsolla-junior-application-security-specialist","title":"Junior Application Security Specialist","company":{"id":2375,"name":"Xsolla","domain":"xsolla.com","url":"https://alion.io/company/xsolla","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":72,"open_postings":179,"ghost_share":0.391,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":66,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Baku, Azerbaijan"],"countries":["AZ"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":22000,"max_usd":63000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":575},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Burp Suite","optional":false},{"name":"Go","optional":false},{"name":"JavaScript","optional":false},{"name":"Least Privilege","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PHP","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SQL","optional":false},{"name":"Threat Modeling","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"CI/CD","optional":true},{"name":"GCP","optional":true}],"status":"live","first_seen_at":"2026-07-07T10:30:27Z","employer_posted_date":"2026-07-07","last_verified_at":"2026-10-22T23:35:41Z","board_verified":true,"closed_at":null,"days_open":107,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":106},"description":"ABOUT YOU\nWe are looking for a junior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will work closely with senior specialists to identify, assess, and help remediate security vulnerabilities across our products and infrastructure.\nYou will be involved in day-to-day AppSec work - code reviews, vulnerability triage, threat modeling, and security testing. You are curious, detail-oriented, and eager to develop deep expertise in application security. You do not need to have all the answers, but you ask the right questions and follow through.\nThis is a strong learning environment. You will be exposed to real-world security challenges in a payment platform operating at scale, and supported by experienced security specialists who will help you grow.\nABOUT US\nXsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game.\nFor more information, visit xsolla.com.\nResponsibilities\nTriage Security Findings - Assess incoming bug bounty reports and scanner findings. Evaluate validity, calculate real severity, and escalate appropriately with clear written summaries.\n\nAssist with Vulnerability Assessments - Participate in security assessments of web applications and APIs. Help identify and document risks in new features and existing systems.\n\nWrite Clear Security Documentation - Document findings, reproduction steps, and remediation guidance in a way that engineering teams can act on.\n\nSupport Threat Modeling - Participate in threat modeling sessions. Learn to identify trust boundaries, data flows, and attack surfaces in system designs.\n\nMonitor Security Tools - Help operate SAST, DAST, and dependency scanning tooling. Track findings, reduce noise, and support remediation workflows.\n\nSupport Code Reviews - Review code for common vulnerability classes under guidance of senior specialists. Learn to identify security issues across PHP, Python, and Go codebases.\n\nStay Current - Follow developments in the security community. Bring awareness of new vulnerability classes, CVEs, and attack techniques relevant to our stack.\n\nWhat You Bring\nWeb Security Fundamentals - Solid understanding of common vulnerability classes: OWASPTop 10, CSRF, XSS, IDOR, SQL injection, open redirect, authentication and session management weaknesses. You understand root causes, not just names.\n\nWeb and Browser Fundamentals - Solid understanding of how web applications work: HTTP request/response cycle, client-server model, REST APIs, how browsers handle same-origin policy, cookies and their attributes, and CORS. This is the foundation everything else builds on.\n\nSecurity Testing Tools - Hands-on experience with Burp Suite or similar web application security testing tools. You have used them to intercept, modify, and replay requests - not just run automated scans.\n\nVulnerability Documentation - Able to reproduce a vulnerability and write it up clearly: reproduction steps, proof of concept, and impact statement. Findings that engineering teams cannot reproduce or understand do not get fixed.\n\nSecure Development Awareness - Familiarity with foundational secure coding concepts: input validation, output encoding, parameterized queries, and least privilege.\n\nCode Readability - Ability to read and follow code in at least one language relevant to web security - PHP, Python, JavaScript, or Go. You don't need to be a developer, but you need to follow logic and spot security-relevant patterns.\n\nAnalytical Thinking - You reason through problems methodically. You can explain not just what a vulnerability is but why it exists, how it is exploited, and what fixing it actually requires.\n\nClear Written Communication - You write findings and summaries that are precise, reproducible, and useful to the engineers who need to act on them.\n\nCuriosity and Initiative - You dig into problems rather than stopping at the surface. When something looks wrong, you investigate before concluding\n\nNice to Have\nParticipation in bug bounty programs or CTFcompetitions;\n\nBasic scripting ability for automation - Python or Bash;\n\nFamiliarity with CI/CD pipelines and where security tooling fits;\n\nExposure to cloud environments - GCP, AWS, or Azure;\n\nRelevant coursework or certifications - eWPT, CEH, PortSwigger Web Security Academy progress, or similar entry-level credentials.","description_format":"text","description_chars":5012,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","E-commerce Platforms","Payment Processing & Gateways","Game Development"],"lifecycle":[{"event":"open","at":"2026-07-07T10:30:27Z"}],"visa":[],"liveness":{"score":24,"band":"cold","label":"Long shot","p_open":1,"p_active":0.654,"p_room":0.36,"age_days":106,"expected_fill_days":66,"reasons":["conf:1","velocity","win:tail","crowd:junior,brand"],"computed_at":"2026-10-22T06:10:10Z"},"pay":null,"html_url":"https://alion.io/job/xsolla-junior-application-security-specialist","json_url":"https://alion.io/job/xsolla-junior-application-security-specialist.json","meta":{"generated_at":"2026-10-23T00:44:47Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1267,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2375},"rest":"https://alion.io/mcp/rest/get_company?id=2375"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fxsolla-junior-application-security-specialist"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fxsolla-junior-application-security-specialist"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fxsolla-junior-application-security-specialist"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/xsolla-junior-application-security-specialist\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fxsolla-junior-application-security-specialist"}]}