--- title: 'Senior Application Security Engineer at SpotOn' canonical: 'https://feeny.ai/job/senior-application-security-engineer-spoton-krakow-lesser-poland-voivodeship-bjyjk27wcxhf' type: 'job' last_seen: '2026-11-09' --- # Senior Application Security Engineer at SpotOn - **Company:** [SpotOn](https://feeny.ai/companies/spoton) - **Location:** Kraków Lesser Poland Voivodeship, Poland - **Employment:** full-time - **Posted:** 2026-10-20 - **Last confirmed live:** 2026-11-09 - **Apply:** https://jobs.ashbyhq.com/spoton/62cf94f0-ee06-4df4-b21b-b2884c7bb7bb ## Job description ## About SpotOn We’re not just building restaurant tech, we’re giving independent restaurants the tools to compete and win. From our award-winning point-of-sale to AI-powered profit tools, everything we do helps operators boost profit, work smarter, and keep their best people. And every solution is backed by real humans who actually give a sh*t about helping restaurants succeed. - Named the #1 Restaurant POS by G2 (Summer 2026), based on ratings from real users - Rated the top-rated point-of-sale (POS) for restaurants, bars, retail, and small businesses by Capterra users - Awarded Great Places to Work and Built In’s Best Workplaces for multiple years running We move fast, care hard, and fight for independent restaurant operators to do what they love, and love doing it. If you’re looking to make an impact with heart and hustle, SpotOn is the place for you. About the Role: SpotOn's Information Security team is hiring a Senior Application Security Engineer to own and mature our application security program. This role maintains the security scanning pipeline (SAST, DAST, dependency, and secrets detection), leads third-party penetration testing engagements, and drives forward newer initiatives like AI/ML pen testing and threat modeling. This person will own program measurement and reporting, building the metrics that demonstrate how our AppSec initiatives are performing and translating that into executive-ready reporting for our Head of Security. This includes defining the right metrics, tracking them consistently, and presenting program trajectory in a way leadership can act on. This is a fully qualified position: you're expected to work independently within established security practices, exercise judgment on findings triage and prioritization, and be a credible technical resource that developers actively want to loop in. On a daily basis you will: Program Measurement & Executive Reporting (priority focus) - Define and own the metrics framework for the AppSec program: what gets measured, why it matters, and how it ties to risk reduction (examples: mean time to remediate by severity, finding density trends over time, scan coverage across the repo portfolio, pen test finding recurrence rate, PR security review adherence). - Establish baselines for each metric to track program trajectory over time. - Build recurring reporting (monthly/quarterly cadence) that translates raw data into a narrative leadership can act on. - Prepare materials for the Head of Security to present to Executive leadership, showing program trajectory and where initiatives are moving the needle. Vulnerability Management & Tooling - Own and maintain the AppSec scanning stack: SAST, DAST, dependency (SCA), and secrets detection across the repo portfolio. - Ensure findings from all scanners display accurately in inventory system for engineering visibility. - Tune scanner configurations to reduce noise and false positives, and keep detection coverage current as new repos and services onboard. Code Review & PR Security Gate - Establish and maintain a consistent PR review practice for security-relevant changes. - Track and report on adherence to this process as one of the program's core metrics. Penetration Testing - Lead and coordinate application penetration testing engagements with our third-party vendor from scoping through remediation tracking. - Serve as the primary point of contact for developers who have questions about pen test findings. - Track pen test outcomes over successive engagements as a measure of whether earlier findings are staying fixed. Strategic Initiatives - Design and implement new AppSec initiatives, including AI-specific penetration testing and formal threat modeling practices. - Define success metrics for each new initiative before it launches, so its impact can be measured rather than assumed. Container & Supply Chain Security - Implement and maintain image trust enforcement. - Partner with Infrastructure/DevOps to ensure image signing and trust policies don't create unnecessary friction in the deployment pipeline. What skill are we looking for? - Bachelor's degree in Computer Science, Information Security, or related field (or equivalent practical experience). - 5+ years of experience in application security, secure code review, or a closely related engineering/security discipline. - Availability to work in a hybrid work model. - Demonstrated experience building or owning security metrics and reporting, ideally with exposure to communicating program health to non-technical or executive audiences. - Hands-on experience with SAST, DAST, and SCA tooling, and with vulnerability management platforms such as DefectDojo. - Demonstrated experience coordinating or directly performing penetration testing, including working with external testing vendors. - Familiarity with container security concepts and admission control (Wiz or equivalent). - Working knowledge of AWS security services and cloud-native application architectures. - Ability to work with minimal day-to-day direction, exercising independent judgment within established security practices. - Strong written and verbal communication skills, with the ability to translate technical findings into business-relevant narrative for leadership. Perfect candidate also has: - Experience presenting security metrics or dashboards to executive stakeholders. - Experience with threat modeling frameworks (STRIDE, PASTA, or similar). - Exposure to AI/ML security testing or red-teaming. - PCI DSS familiarity. Here’s a bit about what we have to offer: - Competitive pay: 18 900 - 23 700 PLN net on B2B. - Training budget 3500 PLN gross per year. - Access to e-learning platforms (O’Reilly). - Fully paid private healthcare in LuxMed. - Access to the Worksmile platform with a monthly top-up. - Subsidized access to breakfast and lunch through the vending machine in Kraków office, and lunches in Gdańsk office once a week. - Group English classes with a native speaker. - New Macbook Pro, 4K monitors or whatever tools you need. - Flexible working hours. - New, modern, bright and comfortable office space in the city centre. - Access to the company’s library. - Great working atmosphere. - Chill out room with a PlayStation and games. - Free snacks and beverages in a kitchen. - Company parties and social activities. - Employee referral program. - Relocation Package within Poland. The controller of your personal data included in your job offer and others collected during the recruitment process is SpotOn Poland spółka z ograniczoną odpowiedzialnością with its registered office in Kraków, Aleja 29 listopada 20, 31-401 Kraków, e-mail address: poland-rodo@spoton.com. We will process your personal data for the purpose of current or, if you voluntarily agree, also future recruitment processes. More information about how we proccess your data, including the basis for processing and your rights in relation to the processing, can be found on our website: https://pl.spoton.com/privacy-and-cookies-policy. Administratorem podanych danych osobowych, w tym danych zawartych w dokumentach aplikacyjnych i zebranych w toku procesu rekrutacji, jest SpotOn Poland Sp. z o.o. z siedzibą w Krakowie (ul. Aleja 29 listopada 20, 31-401 Kraków; adres e-mail do kontaktu: poland-rodo@spoton.com. Dane osobowe będą przetwarzane w celu realizacji obecnych lub – jeżeli wyrazisz na to dobrowolną zgodę – także przyszłych procesów rekrutacji. Więcej informacji o tym, jak przetwarzamy Twoje dane, w tym także informacje o podstawach prawnych przetwarzania oraz o prawach przysługujących Ci w związku z przetwarzaniem danych, znajdziesz na stronie: https://pl.spoton.com/privacy-and-cookies-policy. We will never ask candidates to pay fees, purchase equipment, or share sensitive personal or financial information during the hiring process. All legitimate communication from our recruiting team will come from an official company email address (@[spoton.com](http://spoton.com)). If something seems suspicious, please contact us at careers@spoton.com. SpotOn is an equal employment opportunity employer. Qualified candidates are considered for employment without regard to race, religion, gender, gender identity, sexual orientation, national origin, age, military or veteran status, disability, or any other characteristic protected by applicable law. For U.S. based roles, work authorization in the U.S. is required. Visa sponsorship is not available for this role. SpotOn is an E-Verify company. ## About SpotOn ## Company Overview - **One-liner**: SpotOn provides cloud-based point-of-sale (POS), payments, and software solutions to help restaurants and small-to-medium-sized businesses (SMBs) compete and grow. - **Entity Type**: Private (backed by top-tier venture capital) - **Headquarters**: San Francisco, California, USA (with offices in Chicago, Illinois; Southfield, Michigan; Austin, Texas; and Raleigh, North Carolina) - **Founded**: 2017 - **Founders**: Zach Hyman, Kevin Bryla ## Core Business - **Primary industries**: Restaurant Technology, Financial Services, Payments, SMB Software - **Target customers**: Independent and multi-location restaurants, small and medium-sized businesses (B2B) - **Mission/Purpose**: To help local businesses compete and win with intuitive software, point-of-sale systems, and payment solutions. ## Products & Services - **SpotOn Point-of-Sale (POS)**: A flexible, cloud-based restaurant management system that handles payments, orders, and operations. It includes countertop terminals, handheld devices for tableside ordering/payments, kitchen display systems, and customer-facing displays. - **SpotOn Order**: A commission-free online ordering platform that integrates directly with the POS, including a white-labeled ordering app (GoTo Place), menu management, delivery integrations, and order pacing. - **SpotOn Teamwork**: An all-in-one labor management solution that syncs with the POS for scheduling, tip management, and payroll integration. - **SpotOn Profit Assist**: An AI-powered tool that analyzes restaurant P&L data to identify profit leaks and improve margins. - **SpotOn Terminal**: A simple POS terminal for small businesses, featuring offline mode, cellular connectivity, tipping prompts, and employee tracking. - **Payment Processing**: End-to-end payment gateway and processing services, including options for surcharging/dual pricing. ## Market Standing - **Valuation**: Not publicly disclosed (privately held) - **Key Metric**: Total employees ~2,000 (as of mid-2025). As a private company, revenue is not publicly disclosed. - **Notable Investors/Partners**: Dragoneer Investment Group, Andreessen Horowitz (a16z), 01 Advisors, DST Global, Franklin Templeton. - **Growth Signals**: - Named one of *Fast Company*’s Most Innovative Companies in 2024. - Certified as a Great Place to Work (2023, 2024). - Ranked #1 restaurant point-of-sale on G2 based on user reviews, outpacing Toast and Square in key categories like quality of support and satisfaction. - Expanded product suite with AI-powered profit analysis (Profit Assist) and comprehensive labor management (Teamwork). ## Competitive Advantages - **Integrated, end-to-end platform**: Combines POS, payments, online ordering, marketing, labor management, and AI analytics in a single system that syncs seamlessly. - **Commission-free online ordering**: A major differentiator for restaurants looking to keep more of their revenue. - **High-touch support**: Backed by 24/7 support from real people, which drives industry-leading customer satisfaction scores on third-party review sites. - **Focus on independent restaurants**: Deep specialization in the needs of local and independent operators, not just large chains. ## Strategic Focus - **AI and data-driven tools**: Continued investment in AI features like Profit Assist to help operators improve margins. - **Product expansion**: Growing the suite beyond POS into labor management, marketing automation, and advanced analytics. - **Scale with quality**: Maintaining a high-touch, customer-first support model while scaling to serve more businesses across the U.S. ## Why Work Here - **Culture**: Emphasizes “Be the Client,” diversity of thought, and a supportive community. Values include honesty, respect, transparency, and a “heart and hustle” mentality. - **Work Model**: Hybrid and remote options available depending on role and location. Offices in San Francisco (HQ), Chicago, Austin, Southfield (MI), and Raleigh. - **Benefits**: Medical, dental, vision insurance; 401k with company match; equity grants; flexible time off and holidays; generous parental leave; transit benefits; mental health resources; technology stipend; tuition reimbursement (up to $2k/year). - **Engineering Culture**: Uses modern tech stacks; is actively hiring for Staff AI Engineers and Senior Software Engineers. Recognized as a Built In 2024 Best Place to Work. - **Diversity**: Active Employee Resource Groups (ERGs) and a commitment to diversity of culture, background, experience, and thought. ## Sources 1. [spoton.com](https://www.spoton.com/) 2. [spoton.com/careers](https://www.spoton.com/careers/) 3. [builtin.com](https://builtin.com/company/spoton) 4. [linkedin.com](https://www.linkedin.com/company/spoton) 5. [greatplacetowork.com](https://www.greatplacetowork.com/certified-company/7045280) ## Other roles at SpotOn - [Territory Sales Representative / Restaurant Specialist - South Milwaukee, WI](https://feeny.ai/job/territory-sales-representative-restaurant-specialist-south-milwaukee-wi-spoton-yanqb000mxqb) — South Milwaukee, WI - [WFM Manager](https://feeny.ai/job/wfm-manager-spoton-mexico-city-y40zmmb64mqk) — Mexico City, Mexico - [Business Operations Analyst (Afternoon Shift)](https://feeny.ai/job/business-operations-analyst-afternoon-shift-spoton-krakow-lesser-poland-8t2wm73fzmpp) — Kraków Lesser Poland Voivodeship, Poland - [Territory Sales Representative / Restaurant Specialist - Stateside, NV](https://feeny.ai/job/territory-sales-representative-restaurant-specialist-stateside-nv-spoton-32s3zefpkfqb) — Stateside, NV - [Territory Sales Representative / Restaurant Specialist - O‘ahu, HI](https://feeny.ai/job/territory-sales-representative-restaurant-specialist-o-ahu-hi-spoton-oahu-west-9m2r2dwgk83k) — Oahu West, HI - [Business Development Representative](https://feeny.ai/job/business-development-representative-spoton-mexico-city-re5e3dy8sqpc) — Mexico City, Mexico - [Territory Sales Representative / Restaurant Specialist - Atlanta, GA (Southeast)](https://feeny.ai/job/territory-sales-representative-restaurant-specialist-atlanta-ga-southeast-6rejebxmqjs8) — Atlanta, GA - [Territory Sales Representative / Restaurant Specialist - Gainesville, GA](https://feeny.ai/job/territory-sales-representative-restaurant-specialist-gainesville-ga-spoton-bh2smx6yxw7h) — Gainesville, GA - [Territory Sales Representative / Restaurant Specialist - Downtown Brooklyn](https://feeny.ai/job/territory-sales-representative-restaurant-specialist-downtown-brooklyn-spoton-ws7er5mmg5my) — Dyker Heights, NY - [Territory Sales Representative / Restaurant Specialist - East San Jose, CA](https://feeny.ai/job/territory-sales-representative-restaurant-specialist-east-san-jose-ca-spoton-9cqa4wfw7bbx) — San Jose, CA