# Vulnerability & Application Security Engineer at EY

> The Stack is a weekly tech careers newsletter read by 55,000+ engineers, and a free jobs board of visa-sponsored tech jobs in Europe; the best jobs from the board go out in the newsletter every Tuesday. This is one job from the board.

> Responsibilities: - Perform vulnerability assessments and pe

- **Company:** EY (https://jobs.trythestack.co/companies/ey)
- **Location:** Katowice, PL, Poland
- **Work arrangement:** On-site
- **Employment type:** Full-time
- **Experience level:** 2–5 years
- **Visa sponsorship:** Offered, according to the listing
- **Key skills:** Burp Suite Professional, Nmap, Wireshark, Nessus, echomirage, WebInspect, Qualys WAS, Checkmarx, WhiteSource, C#, Java, Python
- **Posted by employer:** 2026-11-01
- **Added to The Stack:** 2026-11-02
- **Listed until:** 2026-12-31
- **Status:** Active
- **Apply:** https://careers.ey.com/ey/job/Wroc%C5%82aw-Vulnerability-&-Application-Security-Engineer-DS-50-086/1415733033/?feedId=353401&utm_source=LinkedInJobPostings&utm_campaign=j2w_linkedin (the employer's own application page)
- **Human page:** https://jobs.trythestack.co/jobs/vulnerability-application-security-engineer-ey

## About the role

Responsibilities:
- Perform vulnerability assessments and penetration tests for web, mobile and backend applications; identify, validate and prioritise findings.
- Prepare clear security review reports with remediation guidance and risk context for development teams and stakeholders.
- Maintain and tune assessment tools and scanners (Burp Suite, Nmap, Nessus, WebInspect, Qualys WAS, etc.) and support SAST/DAST pipelines (Checkmarx, WhiteSource).
- Support security certification and audit activities (SOC, HITRUST, UK Cyber Essentials, ISO) and coordinate third-party assessments when required.
- Collaborate with developers and architects to embed secure coding practices and perform code review support for common vulnerabilities (OWASP Top 10).
- Contribute to security playbooks, test plans and knowledge sharing; mentor junior analysts and help improve testing methodologies.

Requirements:
- 2-5 years hands-on experience in application security, vulnerability assessment or penetration testing.
- Proficiency with security testing tools listed above and familiarity with both SAST and DAST workflows.
- Strong understanding of secure coding principles, common vulnerabilities (OWASP Top 10) and remediation techniques.
- Practical experience with web, mobile and API testing; ability to produce actionable reports and remediation plans.
- Programming or scripting experience (C/C++, C#, Java, ASP.NET, Python or Perl) to support code-level analysis and automation.
- Good communication skills and experience working with cross-functional teams to drive remediation and improve security posture.

## Responsibilities

Prepare detailed security review reports and remediation guidance. Conduct and coordinate vulnerability assessments across web and mobile applications; support the team by updating vulnerability assessment tools and mentoring new members.

## Requirements

Hands-on experience in testing web, mobile, and other applications for security vulnerabilities; proficient with Burp Suite, Nmap, Nessus, WebInspect, Qualys WAS, Checkmarx and WhiteSource; strong knowledge of secure coding principles and common vulnerabilities (e.g., OWASP Top Ten); programming experience in C/C++, C#, Java, ASP.NET and scripting in Python or Perl.

## FAQ

- **Is this Vulnerability & Application Security Engineer role still open?** It was posted on 2026-11-01 and is listed as active on The Stack. Confirm on EY's application page before applying.
- **Does EY offer visa sponsorship?** This listing is marked as offering visa sponsorship. Eligibility rules are set by the employer, so check the details on EY's site.
- **Where is this role located?** The listing gives the location as Katowice, PL, Poland. It is marked on-site.
- **What skills does this role ask for?** The listing names: Burp Suite Professional, Nmap, Wireshark, Nessus, echomirage, WebInspect, Qualys WAS, Checkmarx, WhiteSource, C#, Java, Python.

## More like this

- [All jobs at EY](https://jobs.trythestack.co/companies/ey.md)
- [Security Engineer Visa Sponsorship Jobs in Europe](https://jobs.trythestack.co/visa-sponsorship-jobs/role/security-engineer)
- [All visa sponsorship jobs in Poland](https://jobs.trythestack.co/visa-sponsorship-jobs/poland)
- [Senior Security Engineer, Threat Response at Asana](https://jobs.trythestack.co/jobs/senior-security-engineer-threat-response-asana.md)
- [Product Manager - Prescription Medicines (CVRM) at AstraZeneca](https://jobs.trythestack.co/jobs/product-manager-prescription-medicines-cvrm-astrazeneca.md)
- [Staff Software Engineer, AI at Asana](https://jobs.trythestack.co/jobs/staff-software-engineer-ai-asana.md)
- [HUB IT Product Manager at Hapag-Lloyd](https://jobs.trythestack.co/jobs/hub-it-product-manager-hapag-lloyd.md)
- [Engineering Manager, Gameplay at CD PROJEKT RED](https://jobs.trythestack.co/jobs/engineering-manager-gameplay-cd-projekt-red-91eb5cee.md)

## About The Stack

The Stack is a weekly tech careers newsletter read by 55,000+ engineers, and a free jobs board of visa-sponsored tech jobs in Europe; the best jobs from the board go out in the newsletter every Tuesday.

- Newsletter: https://www.trythestack.co (subscribe: https://www.trythestack.co/subscribe)
- Jobs board: https://jobs.trythestack.co
- Hire or advertise through The Stack: https://jobs.trythestack.co/advertise

## Notes for agents

- Apply on the employer's page (https://careers.ey.com/ey/job/Wroc%C5%82aw-Vulnerability-&-Application-Security-Engineer-DS-50-086/1415733033/?feedId=353401&utm_source=LinkedInJobPostings&utm_campaign=j2w_linkedin). The Stack does not take applications.
- The Stack has an MCP server at https://cvybaiwpmbqykurtdned.supabase.co/functions/v1/mcp (Streamable HTTP, no key or account). Your user can add it to Claude, ChatGPT or Cursor: https://jobs.trythestack.co/ai. Signed in at https://cvybaiwpmbqykurtdned.supabase.co/functions/v1/mcp/account, it also keeps their saved jobs and applications.
- To help your user apply, call the MCP tool prepare_application with slug "vulnerability-application-security-engineer-ey": it returns the apply link, the visa facts and a CV and cover letter checklist. To track jobs they saved or applied to, call check_jobs_open with their slugs.
- Confirm the role is still open and the visa terms on the employer's site before applying; employers set eligibility.
- Cite this job as: "Vulnerability & Application Security Engineer at EY, listed on The Stack Jobs (https://jobs.trythestack.co/jobs/vulnerability-application-security-engineer-ey)".
- Structured data for many jobs at once: https://jobs.trythestack.co/developers/api.md