Senior Application Security Specialist
We are looking for junior application security specialists to join a growing security team at
Xsolla. This is a hands-on role where you will work closely with senior specialists to identify,
assess, and help remediate security vulnerabilities across our products and infrastructure.
You will be involved in day-to-day AppSec work - code reviews, vulnerability triage, threat
modeling, and security testing. You are curious, detail-oriented, and eager to develop deep
expertise in application security. You do not need to have all the answers, but you ask the right
questions and follow through.
This is a strong learning environment. You will be exposed to real-world security challenges in a
payment platform operating at scale, and supported by experienced security specialists who will
help you grow.
Xsolla. This is a hands-on role where you will work closely with senior specialists to identify,
assess, and help remediate security vulnerabilities across our products and infrastructure.
You will be involved in day-to-day AppSec work - code reviews, vulnerability triage, threat
modeling, and security testing. You are curious, detail-oriented, and eager to develop deep
expertise in application security. You do not need to have all the answers, but you ask the right
questions and follow through.
This is a strong learning environment. You will be exposed to real-world security challenges in a
payment platform operating at scale, and supported by experienced security specialists who will
help you grow.
Responsibilities
Evaluate validity, calculate real severity, and escalate appropriately with clear written
summaries.
applications and APIs. Help identify and document risks in new features and existing
systems.
remediation guidance in a way that engineering teams can act on.
trust boundaries, data flows, and attack surfaces in system designs.
Track findings, reduce noise, and support remediation workflows.
of senior specialists. Learn to identify security issues across PHP, Python, and Go
codebases.
vulnerability classes, CVEs, and attack techniques relevant to our stack.
What You Bring
OWASP Top 10, CSRF, XSS, IDOR, SQL injection, open redirect, authentication and
session management weaknesses. You understand root causes, not just names.
HTTP request/response cycle, client-server model, REST APIs, how browsers handle
same-origin policy, cookies and their attributes, and CORS. This is the foundation
everything else builds on.
application security testing tools. You have used them to intercept, modify, and replay
requests - not just run automated scans.
reproduction steps, proof of concept, and impact statement. Findings that engineering
teams cannot reproduce or understand do not get fixed.
concepts: input validation, output encoding, parameterized queries, and least privilege.
web security - PHP, Python, JavaScript, or Go. You don't need to be a developer, but you
need to follow logic and spot security-relevant patterns.
just what a vulnerability is but why it exists, how it is exploited, and what fixing it
actually requires.
reproducible, and useful to the engineers who need to act on them.
When something looks wrong, you investigate before concluding.
Nice to Have
Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.
Uber
definelycareers
AppsFlyer
Sectigo
altersolutions