Senior Vulnerability & Application Security Engineer
Ernst and Young14 days ago
Wrocław, PolandSenior
Responsibilities
- Prepare detailed security review reports and remediation guidance.
- Research application security vulnerabilities and attack vectors.
- Configure, manage, and update vulnerability assessment tools.
- Work with development teams to configure and use self-scan tools effectively throughout the development lifecycle.
- Help developers interpret scan results, identify false positives, and prioritize remediation.
- Automate application security scanning within CI/CD pipelines.
- Perform manual and automated security testing across web, thick-client, mobile, VoIP, wireless, Android, iOS, and AI-integrated applications.
- Conduct manual code reviews and assess secure coding practices and common vulnerabilities.
- Support security audits, assessments, certifications, and technical compliance activities.
- Lead strategic initiatives, mentor team members, communicate risk and mitigation status, and collaborate with developers, architects, DevOps engineers, vendors, and other stakeholders.
Requirements
- 5–8 years of experience in application security assessment.
- Hands-on experience with web, thick-client, and mobile application security reviews.
- Experience with manual and automated application testing methodologies.
- Proficiency with Burp Professional, Nmap, Wireshark, Nessus, Echo Mirage, WebInspect, Qualys WAS, Checkmarx, and WhiteSource.
- Basic knowledge of C/C++, C#, Java, ASP.NET, Perl, and Python scripting.
- Understanding of secure coding principles, OWASP Top Ten vulnerabilities, and application security requirements for ASP.NET and Java applications.
- Knowledge of TCP/IP, network security, firewalls, IDS/IPS, encryption, and security-focused application and system architecture.
- Experience testing Android and iOS applications, AI-integrated projects, and performing manual code reviews.
- Ability to explain complex security concepts, manage priorities, work across time zones and cultures, and communicate with technical and non-technical stakeholders.
- Ideally, a bachelor’s degree or higher in information technology, cybersecurity, or a related field.
- Interest in pursuing or holding certifications such as CEH, OSCP, CISSP, CISM, CISA, Microsoft Azure, AWS, or GCP.
Benefits
- Hybrid work arrangement in Wrocław or Katowice with 2 days in the office and 3 days remote.
- Continuous learning, coaching, and opportunities to develop skills across a global delivery network.
- Work with international teams, well-known brands, and projects across multiple EY service lines and geographies.
- Diverse and inclusive culture with flexibility to make a meaningful impact.
About Ernst and Young
Ernst & Young (EY) provides audit/assurance, tax, consulting, strategy and transactions services to enterprises, financial institutions, and public‑sector clients. Structured as a global network of partner‑owned member firms, it sells professional services on a fee basis, including a dedicated Financial Services Organization for banking, insurance, and capital markets. Headquartered in London, EY was formed in 1989 from the merger of Ernst & Whinney and Arthur Young, and operates in 150+ countries.