About SpotOn
We’re not just building restaurant tech, we’re giving independent restaurants the tools to compete and win. From our award-winning point-of-sale to AI-powered profit tools, everything we do helps operators boost profit, work smarter, and keep their best people. And every solution is backed by real humans who actually give a sh*t about helping restaurants succeed.
- Named the #1 Restaurant POS by G2 (Summer 2026), based on ratings from real users
- Rated the top-rated point-of-sale (POS) for restaurants, bars, retail, and small businesses by Capterra users
- Awarded Great Places to Work and Built In’s Best Workplaces for multiple years running
About the Role:
SpotOn's Information Security team is hiring a Senior Application Security Engineer to own and mature our application security program. This role maintains the security scanning pipeline (SAST, DAST, dependency, and secrets detection), leads third-party penetration testing engagements, and drives forward newer initiatives like AI/ML pen testing and threat modeling.
This person will own program measurement and reporting, building the metrics that demonstrate how our AppSec initiatives are performing and translating that into executive-ready reporting for our Head of Security. This includes defining the right metrics, tracking them consistently, and presenting program trajectory in a way leadership can act on.
This is a fully qualified position: you're expected to work independently within established security practices, exercise judgment on findings triage and prioritization, and be a credible technical resource that developers actively want to loop in.
On a daily basis you will:
Program Measurement & Executive Reporting (priority focus)
- Define and own the metrics framework for the AppSec program: what gets measured, why it matters, and how it ties to risk reduction (examples: mean time to remediate by severity, finding density trends over time, scan coverage across the repo portfolio, pen test finding recurrence rate, PR security review adherence).
- Establish baselines for each metric to track program trajectory over time.
- Build recurring reporting (monthly/quarterly cadence) that translates raw data into a narrative leadership can act on.
- Prepare materials for the Head of Security to present to Executive leadership, showing program trajectory and where initiatives are moving the needle.
Vulnerability Management & Tooling
- Own and maintain the AppSec scanning stack: SAST, DAST, dependency (SCA), and secrets detection across the repo portfolio.
- Ensure findings from all scanners display accurately in inventory system for engineering visibility.
- Tune scanner configurations to reduce noise and false positives, and keep detection coverage current as new repos and services onboard.
Code Review & PR Security Gate
- Establish and maintain a consistent PR review practice for security-relevant changes.
- Track and report on adherence to this process as one of the program's core metrics.
Penetration Testing
- Lead and coordinate application penetration testing engagements with our third-party vendor from scoping through remediation tracking.
- Serve as the primary point of contact for developers who have questions about pen test findings.
- Track pen test outcomes over successive engagements as a measure of whether earlier findings are staying fixed.
Strategic Initiatives
- Design and implement new AppSec initiatives, including AI-specific penetration testing and formal threat modeling practices.
- Define success metrics for each new initiative before it launches, so its impact can be measured rather than assumed.
Container & Supply Chain Security
- Implement and maintain image trust enforcement.
- Partner with Infrastructure/DevOps to ensure image signing and trust policies don't create unnecessary friction in the deployment pipeline.
What we offer:
- Competitive pay: 18 900 - 23 700 PLN net on B2B.
- Training budget 3500 PLN gross per year.
- Access to e-learning platforms (O’Reilly).
- Fully paid private healthcare in LuxMed.
- Access to the Worksmile platform with a monthly top-up.
- Subsidized access to breakfast and lunch through the vending machine in Kraków office, and lunches in Gdańsk office once a week.
- Group English classes with a native speaker.
- New Macbook Pro, 4K monitors or whatever tools you need.
- Flexible working hours.
- New, modern, bright and comfortable office space in the city centre.
- Access to the company’s library.
- Great working atmosphere.
- Chill out room with a PlayStation and games.
- Free snacks and beverages in a kitchen.
- Company parties and social activities.
- Employee referral program.
- Relocation Package within Poland.
What skill are we looking for?
- Bachelor's degree in Computer Science, Information Security, or related field (or equivalent practical experience).
- 5+ years of experience in application security, secure code review, or a closely related engineering/security discipline.
- Availability to work in a hybrid work model.
- Demonstrated experience building or owning security metrics and reporting, ideally with exposure to communicating program health to non-technical or executive audiences.
- Hands-on experience with SAST, DAST, and SCA tooling, and with vulnerability management platforms such as DefectDojo.
- Demonstrated experience coordinating or directly performing penetration testing, including working with external testing vendors.
- Familiarity with container security concepts and admission control (Wiz or equivalent).
- Working knowledge of AWS security services and cloud-native application architectures.
- Ability to work with minimal day-to-day direction, exercising independent judgment within established security practices.
- Strong written and verbal communication skills, with the ability to translate technical findings into business-relevant narrative for leadership.
Perfect candidate also has:
- Experience presenting security metrics or dashboards to executive stakeholders.
- Experience with threat modeling frameworks (STRIDE, PASTA, or similar).
- Exposure to AI/ML security testing or red-teaming.
- PCI DSS familiarity.
