Hybrid Senior Application Security Engineer – Low-level

at Nord Security

• Job title: Senior Application Security Engineer – Low-level
• Job type: Full Time
• Experience level: Senior
• Salary: Not specified
• Degree requirement: No Education Requirement
• Tech skills: Rust, Go
• Location requirements: Hybrid, Prague, Czech

About the role

• Application Security Engineer working with NordVPN's cybersecurity team. Conducting assessments and reviews to secure applications and systems against vulnerabilities.

Responsibilities

• Conduct security reviews of application designs, source code, and third-party libraries;
• Perform regular application vulnerability assessments using both automated tools and manual testing techniques (e.g., SAST, DAST, SCA, penetration testing);
• Collaborate with development teams to design secure architectures and implement security controls;
• Help maintain security tools, scripts, and processes to support secure development;
• Stay current with industry trends, zero-day vulnerabilities, and best practices in application security;
• Develop scripts and security automation tools to enhance application security testing processes;
• Design and deliver training for security engineering awareness & adoption;
• Actively look for internal security gaps within the product or organization overall;
• Ensure mobile/desktop applications are sufficiently tested and support internal and external audits;

Requirements

• Proven experience in mobile/desktop application security assessment planning, testing, methodologies, and vulnerability reporting;
• Strong understanding of secure coding practices;
• Ability to perform manual security code audit;
• Proficiency in at least one low-level programming language (e.g. C, C++, Rust, Go).
• Solid understanding of networking protocols such as TCP, UDP and the HTTP protocol;
• Familiarity with debuggers (e.g. GDB, LLDB, WinDbg).
• Familiarity with reverse engineering tools (e.g. Ghidra, IDA).
• Solid understanding of memory corruption issues, buffer overflows and related vulnerability classes.
• Familiarity with common authentication and authorization protocols (OAuth, SAML, JWT, etc.).
• Ability to work with networking tools such as Wireshark and tcpdump.
• Ability to quickly assimilate new technologies and tools;
• Sense of ownership with strong problem-solving and investigation skills;
• Ability to build and maintain relationships, influence key stakeholders across the business;
• Bonus points for community contributions like public CVEs, bug bounty recognition, open-source tools, blogs, etc.

Benefits

• Innovate with industry leaders
• Learn & grow
• Hybrid work
• Work from anywhere
• Physical well-being
• Mental & emotional health
• Joyful moments – special treats
• Company events & team-building
• Workation