Senior Application Security Specialist
- Compensation
- Not disclosed
- Location
- Baku
- Work setup
- Onsite
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 4+ years
- Category
- Security
- Posted
Skills
Nice to have
- Track record in bug bounty programs (accepted reports on major platforms) or notable CTF results;
- Strong automation skills - Python or Go for building internal security tooling;
- Experience securing cloud-native environments - GCP preferred; Kubernetes security a plus;
- Advanced certifications - OSWE, OSCP, BSCP, or GWAPT;
- Experience in payments, fintech, or other regulated environments (PCI DSS familiarity);
- CVE credits, public security research, or conference talks.
Full description
ABOUT YOU
We are looking for a senior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will own security initiatives end-to-end - identifying, assessing, and driving remediation of security vulnerabilities across our products and infrastructure.
You will lead day-to-day AppSec work - deep code reviews, vulnerability triage, threat modeling, and security testing - and set the standards for how this work is done. You are rigorous, pragmatic, and able to balance security risk against business velocity in a payment platform operating at scale.
You will also mentor junior specialists and help raise the security bar across engineering teams.
ABOUT US
Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game.
For more information, visit xsolla.com.
Responsibilities
-
Own Vulnerability Management - Lead triage of bug bounty reports and scanner findings. Set severity standards, drive escalation policy, and ensure remediation SLAs are met across teams.
-
Lead Security Assessments - Plan and conduct in-depth security assessments and penetration tests of web applications, APIs, and services. Define assessment scope and methodology.
-
Drive Threat Modeling - Facilitate threat modeling sessions with engineering teams. Identify trust boundaries, data flows, and attack surfaces early in the design phase, and embed the practice into the SDLC.
-
Own AppSec Tooling Strategy - Select, operate, and tune SAST, DAST, SCA, and secrets-scanning tooling. Design noise-reduction and auto-triage workflows; integrate security gates into CI/CD.
-
Lead Secure Code Reviews - Perform security-focused code reviews across PHP, Python, and Go codebases. Define secure coding guidelines and review checklists for engineering teams.