Application Security Engineer

• Long-term, stable contract of employment
• Hybrid work from Gdańsk (3 days from the office, 2 remotely)

O naszym kliencie

A global fintech leader, Acrisure empowers millions of ambitious businesses and individuals with the right solutions to grow boldly forward. By bringing cutting-edge technology and top-tier human support together, we connect clients with customized solutions across insurance, reinsurance, payroll, benefits, cybersecurity, mortgage services, and more. In the last twelve years, Acrisure has grown in revenue from $38 million to nearly $5 billion, with over 19,000 colleagues in more than 20 countries. Acrisure was built on entrepreneurial spirit. Prioritizing leadership, accountability, and collaboration, we equip our teams to work at the highest levels possible.

Opis stanowiska

EU Regulatory Contex

• Design, execute and document security activities in alignment with applicable European Union and Polish legal, regulatory, privacy and operational-resilience requirements, including GDPR, NIS2 and DORA where relevant to the business and service scope.
• Maintain evidence that is clear, reproducible and audit-ready, while applying data minimization, appropriate access controls and defined retention practices.
• Coordinate cross-border work so that testing authorization, handling of personal data, evidence storage and disclosure of findings remain consistent with EU requirements and internal governance.

Security Automation and Integration

• Design, implement and maintain automated security checks across source, build, test and delivery workflows using reusable, vendor-portable components.
• Integrate static analysis (Semgrep), software composition analysis, dynamic application security testing, API security testing, Infrastructure-as-Code review and container assessment into engineering pipelines (GitHub Actions, Azure DevOps, or equivalent).
• Apply AI-assisted security review to support triage, code review, finding correlation, remediation guidance and risk summaries, while keeping outputs explainable, auditable and subject to human validation.
• Create secure-by-default templates, reusable controls and self-service capabilities that reduce manual effort and make the preferred secure path the easiest path.
• Continuously tune rules, thresholds and workflows to reduce noise, improve signal quality and prevent duplicate findings.

Securing AI-Integrated Applications

• Assess AI-integrated application features for prompt injection, insecure output handling, excessive agency, training data leakage and model manipulation, consistent with the OWASP LLM Top 10.
• Review agentic and LLM-backed integrations for authorization boundaries, tool and API exposure, and token scoping.
• Apply enterprise secure-by-default patterns for AI workloads during design and code review, and feed recurring weaknesses back into standards.
• Stay current on the AI threat landscape and translate emerging risks into practical testing and control requirements.

Finding Management and Remediation Enablement

• Feed normalized, enriched and deduplicated findings into the enterprise ASPM platform so that application risk is prioritized in a single consolidated view rather than per-tool or per-region.
• Maintain regional reporting that shows coverage, exposure, remediation progress, aging and recurring weakness patterns, consistent with enterprise ASPM definitions and severity models.
• Partner with engineering teams to reproduce and validate findings, provide practical remediation guidance and confirm effective closure.
• Escalate material or systemic risks through the enterprise risk governance process, supporting exception and risk-acceptance decisions with complete, traceable evidence.
• Use practical exploitation techniques to validate selected findings and establish realistic exploitability, coordinating with the offensive security team for full-scope testing.

Program and Process Development

• Help build a maturing application security process, including standards, operating procedures, service definitions, intake paths, exception handling, documentation and supporting tools, aligned to the enterprise AppSec program.
• Work with development, platform, architecture, offensive security, security operations, privacy, risk and compliance teams across countries and cultures.
• Define and improve measures for scanning coverage, actionable signal, remediation flow, repeat weaknesses and automation effectiveness.
• Identify manual bottlenecks and automate high-volume activities so the team can increase coverage and risk reduction without proportional effort.

Profil kandydata

• Typically 5+ years of relevant hands-on experience in software engineering, application security engineering, DevSecOps, security automation or a closely related discipline.
• Strong software engineering fundamentals and hands-on experience developing automation, integrations, scripts or security tooling using Python, PowerShell, JavaScript/TypeScript, Go or similar languages.
• Hands-on experience integrating security capabilities into CI/CD and software delivery pipelines, such as GitHub Actions, Azure DevOps, GitLab CI, Jenkins or equivalent platforms.
• Practical experience integrating and operating SAST, SCA, DAST, API security, container security and IaC security capabilities.
• Strong source-code review skills, with the ability to distinguish exploitable security defects from scanner noise and explain practical remediation to software engineers.
• Experience working directly with software engineering, DevOps, platform and architecture teams to embed security controls into development workflows.
• Experience using APIs and structured data to automate security workflows, including ingestion, normalization, deduplication, routing and lifecycle management of findings.
• Strong understanding of secure software design, common application and infrastructure vulnerability classes, attack paths and risk-based remediation.
• Working knowledge of penetration-testing techniques sufficient to reproduce vulnerabilities, validate selected findings and establish realistic exploitability.
• Ability to build reusable security controls, templates and self-service capabilities rather than relying primarily on manual security review.
• Strong written and verbal English communication, disciplined technical documentation and the ability to work effectively with technical and non-technical stakeholders in a global environment.

Preffered Qualifications

• Experience securing AI-integrated application features (prompt injection, agentic abuse, model manipulation) and familiarity with OWASP LLM Top 10, MITRE ATLAS or NIST AI RMF.
• Experience using AI/LLM tooling to accelerate code review, triage and remediation guidance at scale.
• Experience with ASPM platforms and risk-based vulnerability prioritization.
• Experience in financial services or another regulated environment.
• Relevant application security, cloud or engineering certifications are beneficial; demonstrated software engineering, automation and security integration experience matters more than certification count.

Oferujemy

• Permanent employment contract.
• Private healthcare package with Luxmed
• Life insurance with Unum
• MyBenefit cafeteria platform
• Real career growth and learning opportunities within a global organization