1 day ago
Kraków, PolandSenior
Responsibilities
- Define and own the AppSec metrics framework, establish measurement baselines, and produce recurring executive-ready reporting.
- Maintain SAST, DAST, dependency/SCA, and secrets-detection scanning across the repository portfolio.
- Ensure scanner findings are accurately represented in the vulnerability inventory and tune tools to reduce noise and false positives.
- Establish and track security-focused pull-request review practices.
- Lead third-party application penetration-testing engagements from scoping through remediation tracking.
- Support developers with penetration-test findings and measure recurrence across engagements.
- Design and implement AI-specific penetration testing and formal threat-modeling initiatives.
- Implement and maintain image-trust enforcement while partnering with Infrastructure and DevOps on image-signing policies.
Requirements
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
- At least 5 years of experience in application security, secure code review, or a closely related engineering or security discipline.
- Hands-on experience with SAST, DAST, SCA, and vulnerability-management platforms such as DefectDojo.
- Experience coordinating or directly performing penetration testing with external vendors.
- Experience building security metrics and reporting, preferably for non-technical or executive audiences.
- Familiarity with container security concepts and admission control, such as Wiz or equivalent.
- Working knowledge of AWS security services and cloud-native application architectures.
- Ability to work independently and exercise judgment within established security practices.
- Strong written and verbal communication skills for translating technical findings into business-relevant narratives.
- Preferred experience with executive security dashboards, STRIDE or PASTA threat-modeling frameworks, AI/ML security testing or red-teaming, and PCI DSS.
Benefits
- Hybrid work model with flexible working hours.
- Competitive pay of 18 900 - 23 700 PLN net on B2B.
- Training budget of 3500 PLN gross per year and access to O’Reilly e-learning.
- Fully paid private healthcare through LuxMed.
- Worksmile platform access with a monthly top-up.
- Subsidized meals in the Kraków and Gdańsk offices.
- Group English classes with a native speaker.
- New MacBook Pro, 4K monitors, and other required equipment.
- Modern central offices, company library, social activities, referral program, and relocation support within Poland.
About SpotOn
SpotOn builds point-of-sale and commerce software for restaurants and local businesses, combining payment processing with tools for online ordering, reservations, loyalty, and reporting. The company sells subscriptions, hardware, and transaction services, often delivered through local sales reps and implementation support. Founded in 2017 and headquartered in San Francisco, it is privately held and focuses on independent restaurant operators across the U.S.