Senior Application Security Specialist

4+ years in application security or a closely related security engineering role, with demonstrable ownership of AppSec programs or major initiatives.

Deep Web Security Expertise - Expert-level understanding of vulnerability classes (OWASP Top 10 and well beyond: SSRF, deserialization, request smuggling, OAuth/OIDC flaws, business logic abuse). You understand root causes, exploitation chains, and realistic impact in production systems.

Offensive Testing Proficiency - Extensive hands-on experience with Burp Suite and manual testing methodology. You can find vulnerabilities that scanners miss and chain low-severity issues into meaningful impact.

Code Fluency - Comfortable reading and auditing code in at least one of: PHP, Python, Go, JavaScript. Able to trace data flows across services and spot vulnerable patterns without runtime access.

Secure SDLC Experience - Practical experience embedding security into development workflows: security requirements, design review, CI/CD security gates, and developer enablement.

Risk Communication - You can calculate and defend real severity, push back on inflated findings, and explain risk to both engineers and leadership in their own language.

Analytical Thinking - You reason through problems methodically and can explain not just what a vulnerability is, but why it exists, how it is exploited, and what fixing it actually requires.

Ownership and Follow-Through - You drive findings to resolution across team boundaries without being asked.

Track record in bug bounty programs (accepted reports on major platforms) or notable CTF results;

Strong automation skills - Python or Go for building internal security tooling;

Experience securing cloud-native environments - GCP preferred; Kubernetes security a plus;

Advanced certifications - OSWE, OSCP, BSCP, or GWAPT;

Experience in payments, fintech, or other regulated environments (PCI DSS familiarity);

CVE credits, public security research, or conference talks.