Novera
Home/Careers / Role profile

Careers / Role profile

Application Security Engineer

An AppSec engineer investigates how vulnerabilities arise and how to fix them in a product. The work includes application audits, threat modelling and security checks during development.

The work

  • Assess application security and take part in threat modelling.
  • Integrate AppSec practices into the SDLC and CI/CD.
  • Identify vulnerabilities in code and dependencies and follow their remediation.
  • Advise development teams and define security requirements.

Role-specific skills

  • Commercial AppSec experience, including independent security audits of web applications, APIs and mobile applications.
  • Knowledge of OWASP Top 10, OWASP API Security Top 10, CWE and SANS Top 25, including exploitation mechanics and defences.
  • Practical SAST and DAST experience with tools such as Semgrep, Checkmarx, SonarQube, Burp Suite, OWASP ZAP or Nuclei.
  • Experience writing custom SAST/DAST rules or templates.
  • Secure SDLC experience, including threat modelling and security reviews of architecture and code.
  • Ability to read and analyse code in one or more of Java, Python, Go, Kotlin or JavaScript/TypeScript.
  • Knowledge of language-specific vulnerability patterns.
  • Understanding of microservices, REST/gRPC, containers and CI/CD from a security perspective.
  • Experience with ASOC or vulnerability management tools.
  • Ability to write technical audit reports, threat models and vulnerability descriptions in Russian.
  • Experience writing WAF rules based on vulnerabilities and threats.
  • Ability to explain vulnerabilities such as SQLi, SSRF, XXE, IDOR and JWT attacks with concrete examples.

Commercial experience

We consider Junior+, Middle and Senior specialists. Each field requires at least six months of relevant commercial experience. Courses and personal projects can add to it.

Courses and personal projects do not replace commercial experience.

Experience using AI tools in commercial work is a plus, with results checked through tests and review and confidentiality respected.

Tell us about your experience

Tell us about an audit or AppSec checks you introduced and your part in remediation. Use anonymised examples without details that could expose another organisation's systems.

Share your experience

We connect with specialists in this field for future projects. This page is a role profile, not an open vacancy.