IT Product Expert (Application & Security Governance), Czech based

We are looking for an experienced IT Product Expert to ensure the security, stability, and reliable operation of customer-facing applications and digital services.

This is a hands-on technical role combining application operations, vulnerability management, monitoring, and security governance. You will investigate issues, assess security findings, support secure releases, and work closely with engineering, infrastructure, product, and security teams to drive improvements.

The role operates in an Agile environment with bi-weekly release cycles.

Details:
Start: ASAP
Location: Remote, with occasional Prague office visits
Contact: B2B
Language: English

Responsibilities:

• Ensure the security, availability, and operational reliability of business applications and digital services.
• Run and improve vulnerability-scanning processes, ensuring appropriate coverage of applications and supporting infrastructure.
• Analyse vulnerabilities and penetration-test findings, assess their impact, validate false positives, and prioritise remediation.
• Work with engineering teams to define practical fixes and verify their effectiveness through rescanning or targeted testing.
• Use logs, metrics, and traces to investigate application issues, access problems, and suspicious activity.
• Build and improve dashboards, alerts, and operational checks to monitor critical services and customer journeys.
• Identify gaps in logging and monitoring, maintain investigation runbooks, and ensure alerts reach the appropriate teams.
• Investigate production incidents, identify root causes, and drive corrective actions with development and operations teams.
• Assess release readiness by reviewing outstanding risks, test results, monitoring coverage, dependencies, and rollback plans.
• Validate application health and security after releases and support urgent security changes.
• Maintain documentation of security controls, remediation progress, risk exceptions, and compensating controls.
• Provide technical evidence for audits, security reviews, and privacy requirements.

Requirements:

• 5+ years of recent hands-on experience in application security, security engineering, DevSecOps, application support, platform operations, or a related technical discipline.
• Practical experience analysing vulnerabilities and managing remediation using tools such as Qualys, Tenable, Rapid7, or equivalent platforms.
• Ability to interpret penetration-test findings and define clear remediation and validation requirements.
• Experience using centralised logging, SIEM, or observability tools for incident investigation, dashboards, and alerting.
• Good understanding of web applications, APIs, HTTP/HTTPS, TLS, networking, operating-system security, and software dependencies.
• Working knowledge of authentication, authorisation, roles, sessions, tokens, and common access-control weaknesses.
• Understanding of production support, incident management, change management, and secure release practices.
• Familiarity with CI/CD security checks and collaboration with engineering teams.
• Strong analytical skills and the ability to communicate technical risks clearly to different stakeholders.
• Relevant education or equivalent professional experience.

Nice to Have:

• Experience with identity platforms and OAuth/OIDC.
• Familiarity with application security testing tools and practices, including SAST, DAST, and SCA.
• Experience with cloud environments or Kubernetes.
• Scripting and automation skills.
• Familiarity with Burp Suite, OWASP ZAP, or similar tools.
• Experience with distributed tracing and multi-tenant applications.
• Relevant security, cloud, or service-management certifications.