Senior Application Security Specialist

What you will do

Own Vulnerability Management – Lead triage of bug bounty reports and scanner findings. Set severity standards, drive escalation policy, and ensure remediation SLAs are met across teams.
Lead Security Assessments – Plan and conduct in-depth security assessments and penetration tests of web applications, APIs, and services. Define assessment scope and methodology.

What you need

About you

We are looking for a senior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will own security initiatives end-to-end - identifying, assessing, and driving remediation of security vulnerabilities across our products and infrastructure.

You will lead day-to-day AppSec work - deep code reviews, vulnerability triage, threat modeling, and security testing - and set the standards for how this work is done. You are rigorous, pragmatic, and able to balance security risk against business velocity in a payment platform operating at scale.

You will also mentor junior specialists and help raise the security bar across engineering teams.

What You Bring

4+ years in application security or a closely related security engineering role, with demonstrable ownership of AppSec programs or major initiatives.
Deep Web Security Expertise – Expert-level understanding of vulnerability classes (OWASP Top 10 and well beyond: SSRF, deserialization, request smuggling, OAuth/OIDC flaws, business logic abuse). You understand root causes, exploitation chains, and realistic impact in production systems.
Offensive Testing Proficiency – Extensive hands-on experience with Burp Suite and manual testing methodology. You can find vulnerabilities that scanners miss and chain low-severity issues into meaningful impact.
Code Fluency – Comfortable reading and auditing code in at least one of: PHP, Python, Go, JavaScript. Able to trace data flows across services and spot vulnerable patterns without runtime access.
Secure SDLC Experience – Practical experience embedding security into development workflows: security requirements, design review, CI/CD security gates, and developer enablement.
Risk Communication – You can calculate and defend real severity, push back on inflated findings, and explain risk to both engineers and leadership in their own language.
Analytical Thinking – You reason through problems methodically and can explain not just what a vulnerability is, but why it exists, how it is exploited, and what fixing it actually requires.
Ownership and Follow-Through - You drive findings to resolution across team boundaries without being asked.

Senior Application Security Specialist

What you will do

Senior Application Security Specialist

What you will do

What you need

About you

What You Bring

Nice to have

About Xsolla

Similar jobs at other companies

Application Security Specialist

Application Security Engineer, X Money

Senior Application Security Engineer

Application Security Architect

Application Security Architect

Application Security Architect

Interview questions

Xsolla