Senior Application Security Specialist

We are looking for a senior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will own security initiatives end-to-end - identifying, assessing, and driving remediation of security vulnerabilities across our products and infrastructure.

You will lead day-to-day AppSec work - deep code reviews, vulnerability triage, threat modeling, and security testing - and set the standards for how this work is done. You are rigorous, pragmatic, and able to balance security risk against business velocity in a payment platform operating at scale.

You will also mentor junior specialists and help raise the security bar across engineering teams.

• 4+ years in application security or a closely related security engineering role, with demonstrable ownership of AppSec programs or major initiatives.

• Deep Web Security Expertise - Expert-level understanding of vulnerability classes (OWASP Top 10 and well beyond: SSRF, deserialization, request smuggling, OAuth/OIDC flaws, business logic abuse). You understand root causes, exploitation chains, and realistic impact in production systems.

• Offensive Testing Proficiency - Extensive hands-on experience with Burp Suite and manual testing methodology. You can find vulnerabilities that scanners miss and chain low-severity issues into meaningful impact.

• Code Fluency - Comfortable reading and auditing code in at least one of: PHP, Python, Go, JavaScript. Able to trace data flows across services and spot vulnerable patterns without runtime access.

• Secure SDLC Experience - Practical experience embedding security into development workflows: security requirements, design review, CI/CD security gates, and developer enablement.

• Risk Communication - You can calculate and defend real severity, push back on inflated findings, and explain risk to both engineers and leadership in their own language.

• Analytical Thinking - You reason through problems methodically and can explain not just what a vulnerability is, but why it exists, how it is exploited, and what fixing it actually requires.

• Ownership and Follow-Through - You drive findings to resolution across team boundaries without being asked.

• Track record in bug bounty programs (accepted reports on major platforms) or notable CTF results;

• Strong automation skills - Python or Go for building internal security tooling;

• Experience securing cloud-native environments - GCP preferred; Kubernetes security a plus;

• Advanced certifications - OSWE, OSCP, BSCP, or GWAPT;

• Experience in payments, fintech, or other regulated environments (PCI DSS familiarity);

• CVE credits, public security research, or conference talks.