We are seeking a Chief Security Engineer to build and lead secure, autonomous validation of network and web application weaknesses through developer-grade scripting and exploit orchestration. You will shape safe, production-ready approaches to continuous security validation and help raise the bar across the engineering organization.

Responsibilities

- Define the strategy for continuous, automated security validation across network and web environments

- Design autonomous exploit chains that safely validate real-world attack paths end to end

- Build and maintain custom automation in Python to orchestrate multi-stage exploit workflows

- Engineer programmatic authentication handling for OAuth, TOTP, and multi-factor authentication flows

- Configure and scale automated validation frameworks and toolchains, including custom pentest robot architectures

- Validate findings in production safely with controls that avoid outages, data corruption, or service degradation

- Translate threat intelligence into prioritized validation scenarios and actionable security outcomes

- Partner with engineering teams to drive remediation plans and verify fixes through repeatable tests

- Assess web and API security risks based on OWASP Top 10 patterns and common authorization flaws

- Evaluate network-level exposure using protocol knowledge and practical attack surface understanding

- Create technical standards and secure practices for exploit automation and validation workflows

Requirements

- 8+ years of security engineering experience with automated validation and offensive security scripting

- 5+ years of leadership experience guiding security engineering strategy and technical direction

- Strong project ownership skills delivering end-to-end security validation initiatives

- Expert exploit chaining knowledge to sequence vulnerabilities into reliable attack paths





- Advanced Python skills for building custom exploits and automation frameworks

- Strong Threat Modeling skills to prioritize realistic attack paths and mitigations

- Strong Vulnerability Management skills to validate, track, and drive remediation outcomes

- Deep Cyber Threat Intelligence expertise to align validation with real-world actor techniques

- Strong web application security knowledge aligned with OWASP Top 10 and API flaws such as IDOR

- Deep network fundamentals knowledge including OSI model and protocols such as DNS, BGP, TCP/IP

- Strong production safety mindset to validate issues without disrupting live services or data

- Upper-Intermediate English proficiency (B2, Upper-Intermediate) for cross-team communication and documentation

Nice to have

- Bash scripting skills for automation and exploit tooling

- Go language skills for building high-performance security tooling

- Multi-Factor Authentication automation experience in validation scripts

- OAuth integration and testing experience in complex auth flows

We offer

- International projects with top brands

- Work with global teams of highly skilled, diverse peers

- Healthcare benefits

- Employee financial programs

- Paid time off and sick leave

- Upskilling, reskilling and certification courses

- Unlimited access to the LinkedIn Learning library and 22,000+ courses

- Integral career opportunities

- Volunteer and community involvement opportunities

- EPAM Employee Groups

- Award-winning culture recognized by Glassdoor, Newsweek and LinkedIn

EPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.

📌 Chief Security Engineer (Colombia)
🏢 EPAM Systems
📍 Colombia