# Senior/Staff Application Security Engineer

**Company**: Nebius
**Location**: Remote - Europe
**Work arrangement**: remote
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/nebius/jobs/4537282101?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_f6ca1182-996

## Description

We are looking for a Senior/Staff Application Security Engineer to ensure the security of our software by identifying and mitigating vulnerabilities, implementing best security practices, and collaborating with development teams.

**Responsibilities:**

- Build and maintain Application Security Posture Management (ASPM) at the Company scale.

- Automate and support SAST, SCA tools, etc as part of CI/CD pipelines.

- Improve SAST, secrets detection rules, and keep the false positive rate low.

- Identify, analyze, and remediate application security vulnerabilities.

- Collaborate with development teams to integrate security best practices into the software development lifecycle (SDLC).

- Develop and maintain secure coding guidelines for development teams.

- Conduct threat modeling and risk assessments for new and existing applications.

- Provide development teams with instruments that facilitate security-related work like threat modelling, vulnerability detection, etc.

- Stay updated on the latest security threats, vulnerabilities, and mitigation techniques.

- Serve as an application security subject matter expert to other teams.

**Requirements:**

- 6+ years of experience in application security.

- Strong knowledge of common application security risks (e.g., OWASP Top 10) and how to mitigate them.

- Experience with secure coding practices in languages such as Python, Go, Java, or JavaScript.

- Proficiency in a common programming language (such as Go or Python) with a willingness to learn Go, if necessary.

- Hands-on experience with security testing tools (Burp Suite, ZAP, Semgrep, etc.).

- Understanding of authentication protocols like SAML or OIDC.

- Experience in conducting threat-modeling sessions.

**Nice to Have:**

- Confidence in presenting your ideas and opinions in a manner that can be challenged, while responding well to feedback.

- Experience in designing, building, and maintaining security automation.

- Experience in translating compliance and regulation requirements into technical specifications.

- Experience in exploiting vulnerabilities in web applications, Linux kernels, containers, and networks.

- Security certifications such as OSCP or OSWE.

**Hiring Process:**

- Recruiter's chat (30mins)

- Live-coding interview (60mins) to assess basic coding skills

- Security interview (60mins) to assess domain expertise

- Security System Design interview (90mins) to assess practical experience

- (Optional) Technical deep dive (90mins) to present a complex and impactful project.

- Final interview to close the hiring process (45mins)

**Benefits & Perks:**

- Competitive compensation

- Career growth and learning opportunities

- Flexibility and ownership

- Collaborative and innovative culture

- Opportunity to work on impactful AI projects

- International environment and talented teams

## Skills

### Required
- application security
- secure coding
- threat modeling
- vulnerability management
- SAST
- SCA
- CI/CD pipelines
- OWASP Top 10
- Python
- Go
- Java
- JavaScript
- Burp Suite
- ZAP
- Semgrep
- SAML
- OIDC

### Nice to have
- security automation
- compliance and regulation
- exploiting vulnerabilities
- OSCP
- OSWE

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/nebius/jobs/4537282101?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)