SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: PLN 18,900 - 23,700 / annual
SpotOn is a restaurant technology company providing point-of-sale systems and AI-powered profit tools to independent restaurants. The company is rated #1 Restaurant POS by G2 and Capterra, and has been recognized as a Great Place to Work.
The Senior Application Security Engineer will own and mature SpotOn's application security program, with a primary focus on program measurement and executive reporting. This is a fully qualified individual contributor role requiring independent judgment and technical credibility within established security practices.
Key Responsibilities:
Program Measurement & Executive Reporting (priority focus):
- Define and own the metrics framework for the AppSec program, including mean time to remediate by severity, finding density trends, scan coverage, pen test finding recurrence rate, and PR security review adherence
- Establish baselines for each metric to track program trajectory over time
- Build recurring monthly/quarterly reporting that translates raw data into actionable narratives for leadership
- Prepare materials for the Head of Security to present to executive leadership
Vulnerability Management & Tooling:
- Own and maintain the AppSec scanning stack: SAST, DAST, dependency (SCA), and secrets detection across the repository portfolio
- Ensure findings display accurately in inventory systems for engineering visibility
- Tune scanner configurations to reduce noise and false positives
Code Review & PR Security Gate:
- Establish and maintain consistent PR review practices for security-relevant changes
- Track and report on adherence to this process
Penetration Testing:
- Lead and coordinate application penetration testing engagements with third-party vendors from scoping through remediation tracking
- Serve as primary point of contact for developers with questions about pen test findings
- Track pen test outcomes over successive engagements
Strategic Initiatives:
- Design and implement new AppSec initiatives, including AI-specific penetration testing and formal threat modeling practices
- Define success metrics for each new initiative before launch
Container & Supply Chain Security:
- Implement and maintain image trust enforcement
- Partner with Infrastructure/DevOps teams
Requirements:
- Bachelor's degree in Computer Science, Information Security, or related field (or equivalent practical experience)
- 5+ years of experience in application security, secure code review, or closely related engineering/security discipline
- Demonstrated experience building or owning security metrics and reporting, with exposure to communicating program health to non-technical or executive audiences
- Hands-on experience with SAST, DAST, and SCA tooling, and vulnerability management platforms such as DefectDojo
- Demonstrated experience coordinating or directly performing penetration testing, including working with external testing vendors
- Familiarity with container security concepts and admission control (Wiz or equivalent)
- Working knowledge of AWS security services and cloud-native application architectures
- Ability to work with minimal day-to-day direction, exercising independent judgment within established security practices
- Strong written and verbal communication skills, with ability to translate technical findings into business-relevant narrative for leadership
- Availability to work in a hybrid work model
Preferred Qualifications:
- Experience presenting security metrics or dashboards to executive stakeholders
- Experience with threat modeling frameworks (STRIDE, PASTA, or similar)
- Exposure to AI/ML security testing or red-teaming
- PCI DSS familiarity
