Junior Application Security Specialist

You will join a growing security team, working closely with senior specialists to identify, assess, and help remediate security vulnerabilities across products and infrastructure. You will be involved in day-to-day AppSec work including code reviews, vulnerability triage, threat modeling, and security testing. You are curious, detail-oriented, and eager to develop deep expertise in application security. You will be exposed to real-world security challenges on a payment platform operating at scale, supported by experienced security specialists who will help you grow.

Responsibilities

• Assess incoming bug bounty reports and scanner findings, evaluate validity, calculate real severity, and escalate appropriately with clear written summaries
• Participate in security assessments of web applications and APIs
• Help identify and document risks in new features and existing systems
• Document findings, reproduction steps, and remediation guidance for engineering teams
• Participate in threat modeling sessions and learn to identify trust boundaries, data flows, and attack surfaces
• Help operate SAST, DAST, and dependency scanning tooling
• Track findings, reduce noise, and support remediation workflows
• Review code for common vulnerability classes under guidance of senior specialists
• Follow developments in the security community and stay aware of new vulnerability classes, CVEs, and attack techniques

Requirements

• Solid understanding of common vulnerability classes: OWASP Top 10, CSRF, XSS, IDOR, SQL injection, open redirect, authentication and session management weaknesses
• Solid understanding of HTTP request/response cycle, client-server model, REST APIs, same-origin policy, cookies, and CORS
• Hands-on experience with Burp Suite or similar web application security testing tools
• Able to reproduce a vulnerability and write it up clearly: reproduction steps, proof of concept, and impact statement
• Familiarity with secure coding concepts: input validation, output encoding, parameterized queries, and least privilege
• Ability to read and follow code in at least one language relevant to web security - PHP, Python, JavaScript, or Go
• Analytical thinking to explain vulnerabilities, exploitation, and remediation
• Clear written communication skills
• Curiosity and initiative to investigate problems