7 months ago
Baku, AzerbaijanSenior
Responsibilities
- Lead vulnerability management, including bug bounty and scanner finding triage, severity standards, escalation policies, and remediation SLAs.
- Plan and conduct security assessments and penetration tests of web applications, APIs, and services.
- Facilitate threat modeling and identify trust boundaries, data flows, and attack surfaces during design.
- Own the strategy, operation, tuning, and workflow integration of AppSec tooling.
- Perform security-focused code reviews in PHP, Python, and Go codebases and define secure coding guidance.
- Mentor junior security specialists, deliver internal training, and promote security awareness among developers.
- Document findings, reproduction steps, and remediation guidance clearly for engineering teams.
Requirements
- 4+ years of application security or closely related security engineering experience with ownership of AppSec programs or major initiatives.
- Expertise in OWASP Top 10 and advanced web vulnerabilities including SSRF, deserialization, request smuggling, OAuth/OIDC flaws, and business logic abuse.
- Extensive hands-on experience with Burp Suite and manual security testing.
- Ability to read and audit at least one of PHP, Python, Go, or JavaScript codebases.
- Practical experience embedding security requirements, design reviews, CI/CD security gates, and developer enablement into development workflows.
- Ability to communicate and defend risk assessments to engineers and leadership and drive findings through resolution.
- Preferred qualifications include bug bounty or CTF experience, Python or Go security automation, GCP or Kubernetes security, OSWE/OSCP/BSCP/GWAPT certifications, payments or PCI DSS experience, and public security research.
Tech Stack
Categories
About Xsolla
Xsolla builds commerce and monetization infrastructure for video games, offering payment processing, merchant-of-record services, storefronts, subscriptions, and anti-fraud tools for developers and publishers. The privately held company, founded in 2005 and headquartered in Sherman Oaks, California, supports direct-to-consumer sales and global tax/compliance across many regions and payment methods. Its platform targets studios from indie to AAA and powers distribution, marketing, and in-game purchases.