Senior Application Security Specialist

About the role

Xsolla is seeking a Senior Application Security Specialist to lead and own end‑to‑end security initiatives across its payment platform and gaming services. This hands‑on position combines deep technical work with mentorship, ensuring that security is embedded in every stage of development.

Key responsibilities

• Own vulnerability management: triage bug bounty reports and scanner findings, set severity standards, and enforce remediation SLAs.
• Plan and conduct security assessments and penetration tests for web applications, APIs, and services.
• Facilitate threat‑modeling sessions, define trust boundaries, and integrate findings into the SDLC.
• Define and operate AppSec tooling strategy (SAST, DAST, SCA, secrets‑scanning) and automate triage workflows.
• Perform secure code reviews for PHP, Python, and Go codebases and establish secure coding guidelines.
• Mentor junior security specialists, deliver internal training, and raise security awareness.
• Document findings, reproduction steps, and remediation guidance with clear standards.

Required profile

• 4+ years of experience in application security or related security engineering.
• Proven ownership of AppSec programs and major security initiatives.
• Strong ability to balance security risk with business velocity in a high‑scale environment.

Required skills

• SAST, DAST, SCA, secrets‑scanning tools
• Secure code review for PHP, Python, Go
• Vulnerability triage and bug bounty management
• Penetration testing and security assessments
• Threat modeling and attack‑surface analysis
• CI/CD pipeline integration