Senior Application Security Engineer

We are looking for a Senior Application Security Engineer to reduce security risk across web applications and APIs throughout the software development lifecycle. You will partner closely with engineering teams to assess application security, perform secure design and code reviews, validate and prioritize findings, and drive remediation to closure.
This role focuses on practical application security outcomes: identifying real risk, reducing false positives, and helping teams build and ship secure software efficiently.
Unlock the potential of remote work in Kazakhstan, giving you the flexibility to work from home or access our offices in Astana, Almaty or Karaganda.
Responsibilities
Perform security assessments of web applications, APIs, services, and supporting components
Facilitate threat modeling and review architectures and technical designs from a security perspective
Conduct secure code reviews and identify vulnerabilities and insecure implementation patterns
Validate findings from automated tools, reduce false positives, and prioritize issues based on exploitability and business impact
Provide clear, actionable remediation guidance and secure implementation recommendations
Track findings through remediation and retesting in collaboration with development teams
Advise teams on authentication, authorization, session management, input validation, data protection, cryptography, secrets handling, and API security controls
Contribute to secure SDLC practices, security standards, guidelines, and reusable security patterns
Communicate security risks and recommendations to technical and non-technical stakeholders
Requirements
Hands-on experience in application security or product security
Strong knowledge of web application and API security, including OWASP Top 10 and common vulnerability classes
Practical experience with security assessments, secure design reviews, and/or secure code reviews
Understanding of threat modeling and secure software design principles
Strong knowledge of authentication, authorization, session management, input validation, cryptography, secrets handling, and data protection
Hands-on experience with one or more application security technologies, such as SAST, DAST, IAST, SCA, or secrets-scanning tools
Ability to validate security findings, distinguish actionable risks from false positives, and prioritize remediation
Ability to read and understand code in at least one programming language (e.g., Java, C#, JavaScript/TypeScript, Python, or Go)
Familiarity with modern application architectures, APIs, distributed services, and common software development practices
Strong communication skills and the ability to provide practical guidance to engineering teams
Nice to have
Experience with DevSecOps practices, including integrating application security tools and security gates into CI/CD pipelines
Experience creating or improving secure SDLC processes, security standards, and developer-facing secure coding guidance
Familiarity with cloud application security concepts (AWS, Microsoft Azure, or Google Cloud)
Knowledge of IAM and application identity concepts (SSO, OAuth 2.0, OpenID Connect, SAML)
Experience with containers/Kubernetes or Infrastructure as Code security (Terraform and similar)
Relevant security certifications (e.g., CSSLP, CISSP) or equivalent practical expertise
We offer
We connect like-minded people:
Delivering innovative solutions to industry leaders, making a global impact
Enjoyable working environment, whether it is the vibrant office or the comfort of your own home
Opportunity to work abroad for up to two months per year
Relocation opportunities within our offices in 55+ countries
Corporate and social events
We invest in your growth:
Leadership development, career advising, soft skills and well-being programs
Certifications, including GCP, Azure and AWS
Unlimited access to EPAM's internal learning database
Free English classes with certified teachers
Discounts in local language schools, including online courses for the Kazakh language
We cover it all:
Participation in the Employee Stock Purchase Plan
Monetary bonuses for engaging in the referral program
Medical & family care package
Six trust days per year (sick leave without a medical certificate)
Coverage of psychology sessions of your choice
Benefits package (sports activities, a variety of stores and services)
Housing support program: preferential mortgage access via Otbasy Bank partnership
EPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.

Work arrangement
Yes