AdTech Holding is an Innovation hub based in Cyprus, which creates vibrant startup ecosystems and technologies for AdTech & MarTech projects.
Since 2011, AdTech Holding has been a starting point for an array of industry-leading advertising and digital marketing companies (PropellerAds, Zeydoo etc). Holding brings the most daring ideas to the market and creates cutting-edge solutions to deliver technology globally.
We are looking for an Application and AI Security Engineer for our Security Department!
Responsibilities:
Run security reviews of services, integrations and public APIs before they go to production, including manual review of critical code.
Do threat modeling for new features with product teams at the design stage.
Own security checks in the development lifecycle (static analysis, dependency scanning, secret detection), covering coverage, rules and triage of findings with teams.
Build a unified vulnerability management process, including the vulnerability register, prioritization, SLAs, retesting and bug bounty.
Secure AI integrations and define access policies for service and AI agent accounts.
Run penetration tests and audits: scope them, accept the results and follow findings through to systemic fixes.
Develop and maintain standards and practices for developers, including secure development requirements, guidelines and team training.
Requirements:
3+ years of experience in application security, covering code and architecture reviews, SAST, DAST, SCA and OWASP.
Strong manual testing skills and hands-on experience with static analysis, including writing your own custom rules.
A solid understanding of how authorization works in practice: OAuth, OIDC, JWT, token scopes and delegated permissions.
Ability to read PHP, Go and JavaScript code and to automate tasks in Python or Bash.
Ability to drive results with teams you don’t manage directly, including through security champions.
Interest in LLM application security, such as prompt injection and AI agents’ access to data.
Working proficiency in Russian and English.
What you should know
Manual testing with Burp Suite or ZAP
Static analysis
Dependency scanning
Secret detection in code
Vulnerability management
OWASP Top 10
OWASP API Security Top 10
OWASP Top 10 for LLM Applications
ASVS
Our stack:
Languages: PHP (Symfony), Go, JavaScript/TypeScript, Python
Data: PostgreSQL, MySQL, ClickHouse
CI/CD: Docker, GitLab/GitHub, TeamCity
Security: SonarQube, Nessus
OS: Linux
Nice to have:
Experience in AdTech or other high-load environments
DevSecOps experience
Experience testing LLM applications
Bug bounty or CTF experience
OSWE or GWEB certification
We offer freedom of choice: with us, you'd have a cafeteria benefits system where you can choose which benefits would fit your individual needs.
And, of course, a standard pack of benefits as well: health insurance, fully covered 10 working days of sick leave per year, 5 additional day-offs per year, English and other languages compensation, quarterly, and annual bonuses, corporate events, gifts, gym at the office, also food (yummy!) - you can find snacks in our worldwide working spaces and breakfasts & lunches in the offices!
Please note, that by applying to this position, you confirm your consent to the processing of your personal data for recruitment purposes
Summary
Run security reviews, threat modeling, and penetration tests for services, APIs and AI integrations while owning SAST, dependency scanning and vulnerability management. Requires 3+ years in application security with SAST, DAST, SCA, OWASP, plus ability to read PHP, Go and JavaScript and automate in Python or Bash.
Responsibilities
Run security reviews of services, integrations and public APIs; threat modeling; own security checks in development lifecycle; vulnerability management and bug bounty; secure AI integrations; penetration tests and audits; develop standards and training
Qualifications
Working proficiency in Russian and English; Ability to read PHP, Go and JavaScript and automate in Python or Bash; understanding of OAuth, OIDC, JWT; interest in LLM application security
Experience requirements
3+ years of experience in application security, covering code and architecture reviews, SAST, DAST, SCA and OWASP
Benefits
health insurance; fully covered 10 working days of sick leave per year; 5 additional day-offs per year; English and other languages compensation; quarterly and annual bonuses; gym at the office; snacks, breakfasts & lunches in offices