<div class="content-intro"><p><strong>About Nebius:</strong></p> <p>Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.</p> <p>Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.</p> <p>Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.</p></div><p><strong>Application Security</strong></p> <p>The team is responsible for the security of Nebius's main public offerings : Compute, VPC, Managed K8s, Marketplace, Managed Soperator, and others. This includes building out the Secure <span data-highlighted="true" data-vc="highlighted-text"><span class="_kqswh2mm"><span class="_5pioz8co _189e1dm9 _1il9buyh _19lc184f _d0altlke" data-testid="definition-highlighter">SDLC</span></span></span>, threat modeling, and vulnerability management platforms.</p> <h4><strong>The Role</strong></h4> <p>We are looking for an <strong>Senior/Staff Application Security Engineer</strong> who will ensure the security of our software by identifying and mitigating vulnerabilities, implementing best security practices, and collaborating with development teams. The ideal candidate will have a strong background in secure coding, threat modeling and building Secure SDLC. </p> <h4>What you will do </h4> <ul> <li>Build and maintain Application Security Posture Management (ASPM) at the Company scale.</li> <li>Automate and support SAST, SCA tools, etc as part of CI/CD pipelines.</li> <li>Improving SAST, secrets detection rules. Keeping false positive rate low.</li> <li>Identify, analyze, and remediate application security vulnerabilities.</li> <li>Collaborate with development teams to integrate security best practices into the software development lifecycle (SDLC).</li> <li>Develop and maintain secure coding guidelines for development teams.</li> <li>Conduct, run threat modeling and risk assessments for new and existing applications.</li> <li>Provide development teams with instruments that facilitate security-related work like threat modelling, vulnerability detection, etc.</li> <li>Stay updated on the latest security threats, vulnerabilities, and mitigation techniques.</li> <li>Serve as an application security subject matter expert to other teams.</li> </ul> <p> </p> <h4>What we look for </h4> <ul> <li>6+ years of experience in application security.</li> <li>Strong knowledge of common application security risks (e.g. OWASP Top 10) and how to mitigate them.</li> <li>Experience with secure coding practices in languages such as Python, Go, Java, or JavaScript.</li> <li>Proficiency in a common programming language (such as Go or Python) with a willingness to learn Go, if necessary.</li> <li>Hands-on experience with security testing tools (Burp Suite, ZAP, Semgrep, etc.).</li> <li>Understanding of authentication protocols like SAML or OIDC.</li> <li>Experience in conducting threat-modeling sessions.</li> </ul> <p> </p> <h4>Bonus points </h4> <ul> <li>Confidence in presenting your ideas and opinions in a manner that can be challenged, while responding well to feedback.</li> <li>Experience in designing, building, and maintaining security automation.</li> <li>Experience in translating compliance and regulation requirements into technical specifications.</li> <li>Experience in exploiting vulnerabilities in web applications, Linux kernels, containers, and networks.</li> <li>Security certifications such as OSCP or OSWE.</li> </ul> <h4>Hiring process</h4> <ul> <li>Recruiter's chat (30mins)</li> <li>Live-coding interview (60mins) to asses basic coding skills </li> <li>Security interview (60mins) to asses domain expertise</li> <li>Security System Design interview (90mins) to assess practical experience</li> <li>(Optional) Technical deep dive (90mins) to present a complex and impact project. </li> <li>Final interview to close the hiring process (45mins)</li> </ul> <p><em data-stringify-type="italic">#LI-CP1</em></p><div class="content-conclusion"><p><strong>Benefits & Perks:</strong></p> <ul> <li>Competitive compensation</li> <li>Career growth and learning opportunities</li> <li>Flexibility and ownership</li> <li>Collaborative and innovative culture</li> <li>Opportunity to work on impactful AI projects</li> <li>International environment and talented teams</li> </ul> <p><strong>What's it like to work at Nebius:</strong></p> <p>Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI </p> <p><strong>Equal Opportunity Statement:</strong></p> <p>Nebius is an equal opportunity em