Senior Application Security Engineer (EPAM SISTEMOS, UAB)

Job description:
EPAM is seeking a skilled Senior Application Security Engineer to help our clients strengthen their security posture.
You will collaborate with a range of security and non-security teams to establish secure coding standards, perform in-depth code reviews, embed SAST/DAST tools within the CI/CD pipeline, and support threat modeling throughout the software development lifecycle.
_This position offers hybrid setup with the flexibility to work from any location in Lithuania, whether it's your home or our dynamic offices in Vilnius and Kaunas._
Perform security assessments, threat modeling, and evaluate penetration testing outcomes for applications
Work alongside developers and other stakeholders to fix identified security weaknesses
Build and deploy automated security testing tools and workflows to detect vulnerabilities
Embed security tools, standards, and processes within the secure software development lifecycle (SSDLC)
Keep current with emerging security threats and update scanning rules accordingly
Provide training and guidance to developers on security best practices and awareness
Shape and drive the security strategy and roadmap for application development
Fine-tune and adapt SAST processes to meet application security needs
Gain thorough knowledge of SAST methodologies and champion their purpose within the development lifecycle
Partner with developers to smoothly incorporate SAST tools into their workflows and CI/CD pipelines
Requirements:
Minimum 5 years of experience in Application Security
Solid background with Checkmarx CxSAST or similar SAST tools
Skilled in CxQL for creating and adjusting scanning rules
Strong grasp of SAST and its function in secure software development
Experience with GitHub and embedding security scans into CI/CD pipelines
Sharp analytical abilities to interpret scan outcomes and enhance scan precision
Effective communication skills for close collaboration with development teams and stakeholders
Comprehensive understanding of DevSecOps principles, focusing on security integration across all development stages
Fluent in English communication at a B2+ level
Nice to have
Familiarity with Python, Go, or other scripting languages and automation tools
General knowledge of Cloud Platforms
Experience with CI/CD tools such as Jenkins, GitLab CI/CD, or Azure DevOps
Background in containerization and orchestration technologies like Docker and Kubernetes
Knowledge of SecOps tools and practices, covering security monitoring, incident response, and threat modeling
Understanding of Infrastructure as Code tools like Terraform or Ansible
Experience with security monitoring and logging tools like ELK Stack or Prometheus
Company offers:
Engineering Heritage: Best-in-class experts sharing a culture of engineering excellence and tackling complex engineering challenges for over 30 years
Advanced Tech Stack: Innovative projects where you can apply or enhance your expertise in Cloud, Data, AI, and other emerging…