Application & AI Security Engineer

AdTech Holding is an Innovation hub based in Cyprus, which creates vibrant startup ecosystems and technologies for AdTech & MarTech projects. Since 2011, AdTech Holding has been a starting point for an array of industry-leading advertising and digital marketing companies (PropellerAds, Zeydoo etc). Holding brings the most daring ideas to the market and creates cutting-edge solutions to deliver technology globally. We are looking for an Application and AI Security Engineer for our Security Department! Responsibilities: - Run security reviews of services, integrations and public APIs before they go to production, including manual review of critical code. - Do threat modeling for new features with product teams at the design stage. - Own security checks in the development lifecycle (static analysis, dependency scanning, secret detection), covering coverage, rules and triage of findings with teams. - Build a unified vulnerability management process, including the vulnerability register, prioritization, SLAs, retesting and bug bounty. - Secure AI integrations and define access policies for service and AI agent accounts. - Run penetration tests and audits: scope them, accept the results and follow findings through to systemic fixes. - Develop and maintain standards and practices for developers, including secure development requirements, guidelines and team training. Requirements: - 3+ years of experience in application security, covering code and architecture reviews, SAST, DAST, SCA and OWASP. - Strong manual testing skills and hands-on experience with static analysis, including writing your own custom rules. - A solid understanding of how authorization works in practice: OAuth, OIDC, JWT, token scopes and delegated permissions. - Ability to read PHP, Go and JavaScript code and to automate tasks in Python or Bash. - Ability to drive results with teams you don’t manage directly, including through security champions. - Interest in LLM application security, such as prompt injection and AI agents’ access to data. - Working proficiency in Russian and English. What you should know - Manual testing with Burp Suite or ZAP - Static analysis - Dependency scanning - Secret detection in code - Vulnerability management - OWASP Top 10 - OWASP API Security Top 10 - OWASP Top 10 for LLM Applications - ASVS Our stack: - Languages: PHP (Symfony), Go, JavaScript/TypeScript, Python - Data: PostgreSQL, MySQL, ClickHouse - CI/CD: Docker, GitLab/GitHub, TeamCity - Security: SonarQube, Nessus - OS: Linux Nice to have: - Experience in AdTech or other high-load environments - DevSecOps experience - Experience testing LLM applications - Bug bounty or CTF experience - OSWE or GWEB certification We offer freedom of choice: with us, you'd have a cafeteria benefits system where you can choose which benefits would fit your individual needs. And, of course, a standard pack of benefits as well: health insurance, fully covered 10 working days of sick leave per year, 5 additional day-offs per year, English and other languages compensation, quarterly, and annual bonuses, corporate events, gifts, gym at the office, also food (yummy!) - you can find snacks in our worldwide working spaces and breakfasts & lunches in the offices! Please note, that by applying to this position, you confirm your consent to the processing of your personal data for recruitment purposes