Junior Application Security Specialist
Xsolla (USA), Inc., operating under the Xsolla brand, is a global video game commerce and payments company serving game developers, publishers, creators, and payment providers.
Maintainer signals as of 9/25/2026
Projects
About Xsolla (USA), Inc.
Xsolla provides merchant-of-record and payment-processing services plus direct-to-consumer commerce, web shops, publishing and distribution tools, cloud gaming, fraud prevention, player engagement, creator monetization, and developer tooling for the video game industry. Its solutions operate across 200+ geographies with 1,000+ payment methods and are actively supported through live products, documentation, customer support, and ongoing hiring.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
Join Xsolla's growing security team to identify, assess, document, and help remediate vulnerabilities across products and infrastructure while developing application security expertise under the guidance of senior specialists.
Requirements
- Understanding of OWASP Top 10, CSRF, XSS, IDOR, SQL injection, open redirects, authentication, and session management weaknesses.
- Understanding of HTTP, client-server architecture, REST APIs, same-origin policy, cookies, and CORS.
- Hands-on experience with Burp Suite or similar web application security testing tools.
- Ability to reproduce vulnerabilities and write clear reports with reproduction steps, proof of concept, and impact statements.
- Familiarity with secure coding concepts including input validation, output encoding, parameterized queries, and least privilege.
- Ability to read code in PHP, Python, JavaScript, or Go.
- Analytical thinking, clear written communication, curiosity, and initiative.
Responsibilities
- Assess bug bounty reports and scanner findings, evaluate validity and severity, and escalate issues with clear summaries.
- Participate in web application and API security assessments.
- Identify and document risks in new and existing features.
- Document findings, reproduction steps, proof of concept, and remediation guidance.
- Participate in threat modeling and identify trust boundaries, data flows, and attack surfaces.
- Help operate SAST, DAST, and dependency scanning tools and support remediation workflows.
- Review code for common vulnerability classes under senior guidance.
- Stay current with vulnerability classes, CVEs, and security techniques.