We are looking for a Lead Security Engineer who combines development depth with offensive security to design autonomous exploit chains and continuous validation. You will help build safe, production-aware automation for web and network security testing and collaborate across engineering to raise the security bar.

Responsibilities

- Design automated exploit chains that sequence vulnerabilities to validate real-world impact

- Build autonomous scripts and tools to orchestrate network and web application exploit workflows

- Implement safe execution controls to validate issues in production without disrupting services

- Configure and scale continuous automated security validation frameworks and test harnesses

- Analyze threat intelligence to prioritize validation scenarios and detection gaps

- Conduct threat modeling to identify high-risk attack paths and required security controls

- Validate and triage findings aligned to OWASP Top 10 and API authorization weaknesses

- Collaborate with engineering to drive remediation plans and verify fixes

- Document attack logic, automation results, and risk narratives for technical audiences

- Guide secure testing standards and code review practices for security automation

- Improve vulnerability management workflows by integrating repeatable validation into pipelines

Requirements

- 5+ years of experience in security engineering with a strong development focus

- 5+ years of experience with Python for security automation and exploit scripting

- Leadership experience guiding technical approaches and code quality for security tooling

- Project experience designing multi-stage exploit chaining and validation workflows





- Strong knowledge of OWASP Top 10 and common API flaws such as IDOR

- Strong threat modeling skills for web and networked systems

- Strong vulnerability management skills, including validation and remediation support

- Strong cyber threat intelligence skills to prioritize and contextualize findings

- Strong understanding of network and web infrastructure, including OSI model and core protocols

- Strong communication skills to explain risk and safe testing approaches to stakeholders

- Upper-Intermediate English (B2) proficiency, both written and spoken

Nice to have

- Go language for exploit development and security tooling

- Bash scripting for automation in security validation environments

- OAuth protocol knowledge for automating authentication flows safely

- Multi-Factor Authentication knowledge, including programmatic handling of TOTP/MFA flows

We offer

- International projects with top brands

- Work with global teams of highly skilled, diverse peers

- Healthcare benefits

- Employee financial programs

- Paid time off and sick leave

- Upskilling, reskilling and certification courses

- Unlimited access to the LinkedIn Learning library and 22,000+ courses

- Integral career opportunities

- Volunteer and community involvement opportunities

- EPAM Employee Groups

- Award-winning culture recognized by Glassdoor, Newsweek and LinkedIn

EPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.

📌 Lead Security Engineer (Colombia)
🏢 EPAM Systems
📍 Colombia