{"id":103432,"url":"https://alion.io/job/xsolla-senior-application-security-specialist","title":"Senior Application Security Specialist","company":{"id":2375,"name":"Xsolla","domain":"xsolla.com","url":"https://alion.io/company/xsolla","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":73,"open_postings":182,"ghost_share":0.363,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":70,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Baku, Azerbaijan"],"countries":["AZ"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":28000,"max_usd":65000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2094},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Burp Suite","optional":false},{"name":"CI/CD","optional":false},{"name":"Go","optional":false},{"name":"JavaScript","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PHP","optional":false},{"name":"Python","optional":false},{"name":"Threat Modeling","optional":false},{"name":"GCP","optional":true},{"name":"Kubernetes","optional":true}],"status":"live","first_seen_at":"2026-04-22T12:20:20Z","employer_posted_date":"2026-04-22","last_verified_at":"2026-10-19T00:17:04Z","board_verified":true,"closed_at":null,"days_open":179,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":178},"description":"ABOUT YOU\nWe are looking for a senior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will own security initiatives end-to-end - identifying, assessing, and driving remediation of security vulnerabilities across our products and infrastructure.\nYou will lead day-to-day AppSec work - deep code reviews, vulnerability triage, threat modeling, and security testing - and set the standards for how this work is done. You are rigorous, pragmatic, and able to balance security risk against business velocity in a payment platform operating at scale.\nYou will also mentor junior specialists and help raise the security bar across engineering teams.\nABOUT US\nXsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game.\nFor more information, visit xsolla.com.\nResponsibilities\nOwn Vulnerability Management - Lead triage of bug bounty reports and scanner findings. Set severity standards, drive escalation policy, and ensure remediation SLAs are met across teams.\n\nLead Security Assessments - Plan and conduct in-depth security assessments and penetration tests of web applications, APIs, and services. Define assessment scope and methodology.\n\nDrive Threat Modeling - Facilitate threat modeling sessions with engineering teams. Identify trust boundaries, data flows, and attack surfaces early in the design phase, and embed the practice into the SDLC.\n\nOwn AppSec Tooling Strategy - Select, operate, and tune SAST, DAST, SCA, and secrets-scanning tooling. Design noise-reduction and auto-triage workflows; integrate security gates into CI/CD.\n\nLead Secure Code Reviews - Perform security-focused code reviews across PHP, Python, and Go codebases. Define secure coding guidelines and review checklists for engineering teams.\n\nMentor and Educate - Coach junior security specialists, run internal security training, and champion security awareness among developers.\n\nWrite Clear Security Documentation - Document findings, reproduction steps, and remediation guidance in a way engineering teams can act on. Set the documentation standard for the team.\n\nWhat You Bring\n4+ years in application security or a closely related security engineering role, with demonstrable ownership of AppSec programs or major initiatives.\n\nDeep Web Security Expertise - Expert-level understanding of vulnerability classes (OWASPTop 10 and well beyond: SSRF, deserialization, request smuggling, OAuth/OIDCflaws, business logic abuse). You understand root causes, exploitation chains, and realistic impact in production systems.\n\nOffensive Testing Proficiency - Extensive hands-on experience with Burp Suite and manual testing methodology. You can find vulnerabilities that scanners miss and chain low-severity issues into meaningful impact.\n\nCode Fluency - Comfortable reading and auditing code in at least one of: PHP, Python, Go, JavaScript. Able to trace data flows across services and spot vulnerable patterns without runtime access.\n\nSecure SDLCExperience - Practical experience embedding security into development workflows: security requirements, design review, CI/CD security gates, and developer enablement.\n\nRisk Communication - You can calculate and defend real severity, push back on inflated findings, and explain risk to both engineers and leadership in their own language.\n\nAnalytical Thinking - You reason through problems methodically and can explain not just what a vulnerability is, but why it exists, how it is exploited, and what fixing it actually requires.\n\nOwnership and Follow-Through - You drive findings to resolution across team boundaries without being asked.\n\nNice to Have\nTrack record in bug bounty programs (accepted reports on major platforms) or notable CTFresults;\n\nStrong automation skills - Python or Go for building internal security tooling;\n\nExperience securing cloud-native environments - GCP preferred; Kubernetes security a plus;\n\nAdvanced certifications - OSWE, OSCP, BSCP, or GWAPT;\n\nExperience in payments, fintech, or other regulated environments (PCIDSSfamiliarity);\n\nCVEcredits, public security research, or conference talks.","description_format":"text","description_chars":4789,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","E-commerce Platforms","Payment Processing & Gateways","Game Development"],"lifecycle":[{"event":"open","at":"2026-04-22T12:20:20Z"}],"visa":[],"liveness":{"score":17,"band":"cold","label":"Long shot","p_open":1,"p_active":0.616,"p_room":0.28,"age_days":177,"expected_fill_days":70,"reasons":["conf:3","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/xsolla-senior-application-security-specialist","json_url":"https://alion.io/job/xsolla-senior-application-security-specialist.json","meta":{"generated_at":"2026-10-19T01:21:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":625,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2375},"rest":"https://alion.io/mcp/rest/get_company?id=2375"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fxsolla-senior-application-security-specialist"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fxsolla-senior-application-security-specialist"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fxsolla-senior-application-security-specialist"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/xsolla-senior-application-security-specialist\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fxsolla-senior-application-security-specialist"}]}