adtechholding
Application & AI Security Engineer
- Compensation
- Not disclosed
- Location
- Limassol, Cyprus
- Work setup
- Hybrid
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 3+ years
- Category
- Security
- Posted
Skills
Must have
- 3+ years of experience in application security, covering code and architecture reviews, SAST, DAST, SCA and OWASP.
- Strong manual testing skills and hands-on experience with static analysis, including writing your own custom rules.
- A solid understanding of how authorization works in practice: OAuth, OIDC, JWT, token scopes and delegated permissions.
- Ability to read PHP, Go and JavaScript code and to automate tasks in Python or Bash.
- Ability to drive results with teams you don’t manage directly, including through security champions.
- Interest in LLM application security, such as prompt injection and AI agents’ access to data.
- Working proficiency in Russian and English.
Nice to have
- Experience in AdTech or other high-load environments
- DevSecOps experience
- Experience testing LLM applications
- Bug bounty or CTF experience
- OSWE or GWEB certification
Full description
AdTech Holding is an Innovation hub based in Cyprus, which creates vibrant startup ecosystems and technologies for AdTech & MarTech projects.
Since 2011, AdTech Holding has been a starting point for an array of industry-leading advertising and digital marketing companies (PropellerAds, Zeydoo etc). Holding brings the most daring ideas to the market and creates cutting-edge solutions to deliver technology globally.
We are looking for an Application and AI Security Engineer for our Security Department!
Responsibilities:
- Run security reviews of services, integrations and public APIs before they go to production, including manual review of critical code.
- Do threat modeling for new features with product teams at the design stage.
- Own security checks in the development lifecycle (static analysis, dependency scanning, secret detection), covering coverage, rules and triage of findings with teams.
- Build a unified vulnerability management process, including the vulnerability register, prioritization, SLAs, retesting and bug bounty.
- Secure AI integrations and define access policies for service and AI agent accounts.
- Run penetration tests and audits: scope them, accept the results and follow findings through to systemic fixes.
- Develop and maintain standards and practices for developers, including secure development requirements, guidelines and team training.
Requirements:
- 3+ years of experience in application security, covering code and architecture reviews, SAST, DAST, SCA and OWASP.
- Strong manual testing skills and hands-on experience with static analysis, including writing your own custom rules.
- A solid understanding of how authorization works in practice: OAuth, OIDC, JWT, token scopes and delegated permissions.
- Ability to read PHP, Go and JavaScript code and to automate tasks in Python or Bash.
- Ability to drive results with teams you don’t manage directly, including through security champions.
- Interest in LLM application security, such as prompt injection and AI agents’ access to data.
- Working proficiency in Russian and English.
What you should know
- Manual testing with Burp Suite or ZAP
- Static analysis
- Dependency scanning
- Secret detection in code
- Vulnerability management
- OWASP Top 10