EPAM Systems
Lead/Senior Security System Engineer
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Not specified
- Seniority
- Lead
- Employment
- Not specified
- Experience
- 6+ years
- Category
- Software engineering
- Posted
Skills
Must have
- 6-15 years of overall experience in IT, with a focus on application security, cloud security and software supply-chain security
- Expertise in Checkmarx, CodeQL, SAST/DAST, secure code review and secure SDLC practices
- Proficiency in AWS, Wiz, IAM and cloud configuration security
- Skills in JFrog Xray, dependency analysis, Chainguard and SBOM concepts
- Background in DevSecOps, vulnerability triage, root-cause analysis and remediation pattern development
- Knowledge of security automation and vulnerability management at scale
- Familiarity with GitHub repository migration, GitHub Actions and Azure DevOps pipeline migration
- Understanding of artifact and dependency governance, curation policies and automated policy validation
- Capability to lead technical teams and provide guidance to senior security engineers
- Experience working within large-scale, portfolio-wide security enablement programs
Full description
We are seeking a Lead/Senior Security System Engineer to lead vulnerability triage, technical analysis, remediation guidance, and the development of reusable fix patterns across applications, cloud environments, and the software supply chain. This role involves close collaboration with product and development teams to strengthen secure engineering practices, drive DevSecOps transformation initiatives, and reduce security exposure across a large-scale portfolio.
Responsibilities
- Lead technical triage, validation and prioritization of security vulnerabilities
- Analyze findings from Checkmarx, CodeQL, Wiz and JFrog Xray
- Direct investigation of application-code, cloud-configuration, IAM, dependency and software supply-chain vulnerabilities
- Develop proof-of-concept fixes, remediation guidance and reusable fix patterns
- Perform secure-code reviews and provide actionable recommendations to development teams
- Create remediation playbooks, runbooks and technical guidance
- Support root-cause analysis for recurring or complex vulnerabilities
- Review engineering outputs and provide technical guidance to Senior Security Engineers
- Partner with product/development teams to improve secure engineering practices and reduce recurring findings
- Support vulnerability reduction planning, prioritized backlogs, risk reporting and recurring trend analysis
- Guide GitHub repository migration, GitHub Actions and Azure DevOps pipeline migration, and related runners, secrets, permissions and deployment integrations
- Contribute to Checkmarx onboarding, DevSecOps controls, automated quality gates and Golden Pipeline modernization
Requirements
- 6-15 years of overall experience in IT, with a focus on application security, cloud security and software supply-chain security
- Expertise in Checkmarx, CodeQL, SAST/DAST, secure code review and secure SDLC practices
- Proficiency in AWS, Wiz, IAM and cloud configuration security
- Skills in JFrog Xray, dependency analysis, Chainguard and SBOM concepts
- Background in DevSecOps, vulnerability triage, root-cause analysis and remediation pattern development
- Knowledge of security automation and vulnerability management at scale
- Familiarity with GitHub repository migration, GitHub Actions and Azure DevOps pipeline migration
- Understanding of artifact and dependency governance, curation policies and automated policy validation
- Capability to lead technical teams and provide guidance to senior security engineers
- Experience working within large-scale, portfolio-wide security enablement programs
Benefits
Opportunity to work on technical challenges that may impact across geographies