We are seeking a seasoned Application Security & Vulnerability Validation Engineer to serve as the operational and technical bridge between automated/AI-driven security scanning and remediation systems and product engineering teams.
In this role, you will streamline service threat modeling, eliminate scanner triage noise, build minimal proofs-of-concept (PoCs) to validate exploitability, perform rigorous quality assurance on AI/agent-generated security patches, and partner with software engineers to drive confirmed vulnerabilities to verified production closure.
Responsibilities
Construct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findings
Distinguish true, exploitable vulnerabilities from scanner false positives and attach clear, reproducible evidence to issue tickets
Supervise, review, and validate code patches generated by automated and AI/agentic remediation systems before they are routed to product code owners
Inspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and unintended functional regressions
Execute unit, integration, and differential tests to confirm both fix efficacy and build stability (targeting a ≥90% patch acceptance rate by code owners without major revision)
Review, filter, and prioritize incoming findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24–48 hour turnaround window
Classify vulnerability severity using standardized scoring rubrics and map valid findings to strict remediation SLAs
Evaluate standard compliance exception requests against established security policies and escalate ambiguous, disputed, or architectural edge cases to senior security leads
Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services
Maintain standardized threat models and service risk classification tags in centralized repositories
Shepherd fixes through code review, track remediation SLAs, and verify end-to-end deployment to production
Requirements
5+ years of hands-on experience in Application Security, Product Security, or Software Engineering with a strong focus on vulnerability validation, secure code review, and test automation
Proficiency in reading, writing, and debugging code in at least two core languages (C++, Go, Java, or Python), with the ability to set up local test harnesses, mock dependencies, and build minimal PoCs
Deep understanding of secure coding standards (input validation, boundary checking, safe memory access, concurrency safety) and high attention to detail when reviewing code diffs for regressions, hallucinations, or off-by-one errors
Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflows
Understanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks (e.g., STRIDE, PASTA)
Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate constructively with software engineering owners through code review
Nice to have
Experience validating, debugging, or prompt-tuning automated code generation tools, along with automated patch validation and differential testing
Practical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across services
Communication
Senior
Pay
Pay is not stated in the ad.
Estimate take-home pay for a figure you enter
Estimated take-home pay
Explore gross pay after typical payroll taxes for a work location.
Illustrative estimate only; assumes a standard employee profile and may omit benefits, pensions, credits and local rules. Regional and city-specific tax applies only where the selected calculator supports it; other results are country-level. Salary and location are sent only when you calculate: Paysums for supported regions, or WorthOf for wider country coverage. Confirm with an official payroll or tax source before making decisions.
Visa sponsorship and relocation: not stated in the ad.
JobCheckPoint never asks candidates to pay, and genuine employers shouldn't either. If this job asks you for money (registration, training, visa or equipment fees), don't pay. Report it below.
