Application Security Engineer

HighCraft is looking for an Application Security Engineer to assess a healthcare platform for practitioners and patients.

This is an ongoing remote, part-time contract, starting with a security assessment estimated at 40–60 hours. You will then provide security reviews and support as new features and integrations are developed.

What you will do

• Perform manual security assessments of web applications and APIs.

• Identify and validate vulnerabilities in authentication, access controls, business logic and data handling.

• Review security-sensitive changes and third-party integrations.

• Document findings with clear evidence, reproduction steps and practical remediation guidance.

• Work with developers to resolve security issues and retest fixes.

What we are looking for

• Hands-on experience independently testing authenticated web applications and APIs.

• Practical understanding of OWASP web and API security, authentication, authorization and multi-tenant applications.

• Ability to investigate and validate findings manually using HTTP requests and application behavior.

• Clear technical reporting and practical remediation guidance.

• Upper-Intermediate English (B2), with the ability to discuss findings with developers.

• Ukrainian is required for day-to-day team communication.

Experience with Burp Suite, .NET, Azure or healthcare systems is a plus.

To apply

Please include:

• Your relevant web/API security testing experience.

• Your expected hourly rate.

• Your weekly availability and earliest start date.

• A brief, anonymized example of a security issue you identified and how you documented it.