Senior Application Security Engineer

About SpotOn

We’re not just building restaurant tech, we’re giving independent restaurants the tools to compete and win. From our award-winning point-of-sale to AI-powered profit tools, everything we do helps operators boost profit, work smarter, and keep their best people. And every solution is backed by real humans who actually give a sh*t about helping restaurants succeed.

• Named the #1 Restaurant POS by G2 (Summer 2026), based on ratings from real users

• Rated the top-rated point-of-sale (POS) for restaurants, bars, retail, and small businesses by Capterra users

• Awarded Great Places to Work and Built In’s Best Workplaces for multiple years running

We move fast, care hard, and fight for independent restaurant operators to do what they love, and love doing it. If you’re looking to make an impact with heart and hustle, SpotOn is the place for you.

About the Role:

SpotOn's Information Security team is hiring a Senior Application Security Engineer to own and mature our application security program. This role maintains the security scanning pipeline (SAST, DAST, dependency, and secrets detection), leads third-party penetration testing engagements, and drives forward newer initiatives like AI/ML pen testing and threat modeling.

This person will own program measurement and reporting, building the metrics that demonstrate how our AppSec initiatives are performing and translating that into executive-ready reporting for our Head of Security. This includes defining the right metrics, tracking them consistently, and presenting program trajectory in a way leadership can act on.

This is a fully qualified position: you're expected to work independently within established security practices, exercise judgment on findings triage and prioritization, and be a credible technical resource that developers actively want to loop in.

On a daily basis you will:

Program Measurement & Executive Reporting (priority focus)

• Define and own the metrics framework for the AppSec program: what gets measured, why it matters, and how it ties to risk reduction (examples: mean time to remediate by severity, finding density trends over time, scan coverage across the repo portfolio, pen test finding recurrence rate, PR security review adherence).

• Establish baselines for each metric to track program trajectory over time.

• Build recurring reporting (monthly/quarterly cadence) that translates raw data into a narrative leadership can act on.

• Prepare materials for the Head of Security to present to Executive leadership, showing program trajectory and where initiatives are moving the needle.

Vulnerability Management & Tooling

• Own and maintain the AppSec scanning stack: SAST, DAST, dependency (SCA), and secrets detection across the repo portfolio.

• Ensure findings from all scanners display accurately in inventory system for engineering visibility.

• Tune scanner configurations to reduce noise and false positives, and keep detection coverage current as new repos and services onboard.

Code Review & PR Security Gate

• Establish and maintain a consistent PR review practice for security-relevant changes.

• Track and report on adherence to this process as one of the program's core metrics.

Penetration Testing

• Lead and coordinate application penetration testing engagements with our third-party vendor from scoping through remediation tracking.

• Serve as the primary point of contact for developers who have questions about pen test findings.

• Track pen test outcomes over successive engagements as a measure of whether earlier findings are staying fixed.

Strategic Initiatives

• Design and implement new AppSec initiatives, including AI-specific penetration testing and formal threat modeling practices.

• Define success metrics for each new initiative before it launches, so its impact can be measured rather than assumed.

Container & Supply Chain Security

• Implement and maintain image trust enforcement.

• Partner with Infrastructure/DevOps to ensure image signing and trust policies don't create unnecessary friction in the deployment pipeline.

What skill are we looking for?

• Bachelor's degree in Computer Science, Information Security, or related field (or equivalent practical experience).

• 5+ years of experience in application security, secure code review, or a closely related engineering/security discipline.

• Availability to work in a hybrid work model.

• Demonstrated experience building or owning security metrics and reporting, ideally with exposure to communicating program health to non-technical or executive audiences.

• Hands-on experience with SAST, DAST, and SCA tooling, and with vulnerability management platforms such as DefectDojo.

• Demonstrated experience coordinating or directly performing penetration testing, including working with external testing vendors.

• Familiarity with container security concepts and admission control (Wiz or equivalent).

• Working knowledge of AWS security services and cloud-native application architectures.

• Ability to work with minimal day-to-day direction, exercising independent judgment within established security practices.

• Strong written and verbal communication skills, with the ability to translate technical findings into business-relevant narrative for leadership.

Perfect candidate also has:

• Experience presenting security metrics or dashboards to executive stakeholders.

• Experience with threat modeling frameworks (STRIDE, PASTA, or similar).

• Exposure to AI/ML security testing or red-teaming.

• PCI DSS familiarity.

Here’s a bit about what we have to offer:

• Competitive pay: 18 900 - 23 700 PLN net on B2B.

• Training budget 3500 PLN gross per year.

• Access to e-learning platforms (O’Reilly).

• Fully paid private healthcare in LuxMed.

• Access to the Worksmile platform with a monthly top-up.

• Subsidized access to breakfast and lunch through the vending machine in Kraków office, and lunches in Gdańsk office once a week.

• Group English classes with a native speaker.

• New Macbook Pro, 4K monitors or whatever tools you need.

• Flexible working hours.

• New, modern, bright and comfortable office space in the city centre.

• Access to the company’s library.

• Great working atmosphere.

• Chill out room with a PlayStation and games.

• Free snacks and beverages in a kitchen.

• Company parties and social activities.

• Employee referral program.

• Relocation Package within Poland.

The controller of your personal data included in your job offer and others collected during the recruitment process is SpotOn Poland spółka z ograniczoną odpowiedzialnością with its registered office in Kraków, Aleja 29 listopada 20, 31-401 Kraków, e-mail address:
poland-rodo@spoton.com. We will process your personal data for the purpose of current or, if you voluntarily agree, also future recruitment processes. More information about how we proccess your data, including the basis for processing and your rights in relation to the processing, can be found on our website: https://pl.spoton.com/privacy-and-cookies-policy.

Administratorem podanych danych osobowych, w tym danych zawartych w dokumentach aplikacyjnych i zebranych w toku procesu rekrutacji, jest SpotOn Poland Sp. z o.o. z siedzibą w Krakowie (ul. Aleja 29 listopada 20, 31-401 Kraków; adres e-mail do kontaktu:
poland-rodo@spoton.com. Dane osobowe będą przetwarzane w celu realizacji obecnych lub – jeżeli wyrazisz na to dobrowolną zgodę – także przyszłych procesów rekrutacji. Więcej informacji o tym, jak przetwarzamy Twoje dane, w tym także informacje o podstawach prawnych przetwarzania oraz o prawach przysługujących Ci w związku z przetwarzaniem danych, znajdziesz na stronie:
https://pl.spoton.com/privacy-and-cookies-policy.

We will never ask candidates to pay fees, purchase equipment, or share sensitive personal or financial information during the hiring process. All legitimate communication from our recruiting team will come from an official company email address (@spoton.com). If something seems suspicious, please contact us at careers@spoton.com.

SpotOn is an equal employment opportunity employer. Qualified candidates are considered for employment without regard to race, religion, gender, gender identity, sexual orientation, national origin, age, military or veteran status, disability, or any other characteristic protected by applicable law.

For U.S. based roles, work authorization in the U.S. is required. Visa sponsorship is not available for this role.

SpotOn is an E-Verify company.