Adtech Holding — an international group of companies engaged in the creation and development of products based on advanced technologies in the field of online advertising.
Almost everything we protect is written by us: services through which advertiser traffic and money flow, public APIs, client dashboards.
There is no separate application security function in the company yet. You will build it for a team of about 40 developers — starting with an inventory of the attack surface and priorities.
Locations: Serbia, Cyprus. Relocation.
Salary: 3,000 — 5,000 €/month before taxes.
Responsibilities
- Security review of services, integrations, and public APIs before going live, including manual analysis of critical code.
- Threat modeling of new features together with product teams at the design stage.
- Checks in the development cycle: static analysis, dependencies, secrets detection — coverage, rules, analysis of findings with teams.
- Creation of a unified vulnerability management process: registry, priorities, SLA, retest, bug bounty.
- Ensuring the security of AI integrations and access rules for technical and agency accounts.
- Conducting penetration tests and audits: initiation, acceptance, driving findings to systematic correction.
- Development and maintenance of standards and practices for developers: secure development requirements, guidelines, team training.
Who we are looking for
- At least 3 years of experience in application security: code and architecture review, SAST, DAST, SCA, OWASP.
- Solid manual testing skills and experience with static analysis, including writing custom rules.
- Understanding of authorization mechanisms: OAuth, OIDC, JWT, scope tokens, rights delegation.
- Ability to read code in PHP, Go, and JavaScript and automate tasks in Python or Bash.
- Ability to achieve results from teams without direct authority, including through security champions.
- Interest in LLM application security: prompt injection, agent access to data.
- Russian and English languages at a working level.
What you need to know
- Manual testing — Burp Suite or ZAP.
- Static analysis.
- Dependency checking.
- Secrets detection in code.
- Vulnerability tracking.
- OWASP Top 10.
- OWASP API Security Top 10.
- OWASP Top 10 for LLM Applications.
- ASVS.
Our stack
- Languages: PHP (Symfony), Go, JavaScript/TypeScript, Python.
- Data: PostgreSQL, MySQL, ClickHouse.
- Build: Docker, GitLab/GitHub, TeamCity.
- Security: SonarQube, Nessus.
- OS: Linux.
Nice to have
- AdTech or other high-load experience.
- DevSecOps.
- LLM application testing.
- Bug bounty or CTF.
- OSWE or GWEB.
We offer
- A "cafeteria" benefits system that allows you to choose perks that best suit your lifestyle and needs.
- Medical insurance.
- Fully paid sick leave (10 working days per year).
- 5 additional paid days off per year.
- Quarterly and annual bonuses for work results.
- Compensation for English and other language studies.
- Budget for professional training and conferences.
- Corporate events, breakfasts, and lunches in the office.
