Open to opportunities

German Vengerov

@0003548

Message

I lead application security, building AppSec programs and security automation.

Serbia

Message

What I'm looking for

I’m looking to lead application/product security, build scalable AppSec processes (secure SDLC, threat modeling, reviews), and drive security automation with strong engineering partnership—open to international relocation and compliant sponsorship if needed.

I’m an application security leader with 7+ years of experience spanning software testing, software development, penetration testing, mobile security, and product security. I’ve built AppSec capabilities from the ground up, combining hands-on engineering with security leadership.

At HeadHunter, I established the Application Security function and scaled it into a five-person team within one year. I run security triage and validation for SAST/DAST findings, introduced a continuous architecture decision review process (about 200 reviews), and helped reduce false positives by collaborating directly with engineering teams on remediation priorities.

I’ve owned vulnerability management workflows and SLAs to make security debt transparent and planned for product teams. I also led the migration of 100 product teams to HashiCorp Vault, integrated Wallarm WAF as part of the application protection program, and personally hired seven AppSec engineers while managing performance reviews and planning.

Previously at Ozon, I completed 235 application security reviews, delivered secure code and architecture reviews, and trained ~10,000 developers as a prerequisite for GitLab access. I coordinated external penetration tests and built an automation service in Python to parse third-party security reports and generate Jira remediation tasks.

Experience

Work history, roles, and key accomplishments

Current

Lead Application Security Engineer

Current

HeadHunter

Apr 2025 - Present (1 year 3 months)

Built the Application Security function from the ground up and scaled it to a five-person team, supporting security validation for SAST and DAST findings. Established continuous architecture decision reviews, designed vulnerability management workflows, led migration to HashiCorp Vault, and operated a Wallarm WAF program.

Application Security Product Security Secure SDLC Security Architecture Review Secure Code Review Vulnerability Management SAST DAST Security Triage Wallarm Security Testing People Management Team Leadership

Application Security Engineer

Ozon

Jan 2023 - Apr 2025 (2 years 3 months)

Performed application security, secure code, and architecture decision reviews across product engineering, applying threat modeling and secure SDLC practices. Led bug bounty triage and escalation, coordinated external penetration/red-team engagements, and built a Python service to convert third-party security reports into Jira remediation tasks.

Application Security Product Security Secure SDLC Threat Modeling Secure Code Review Security Architecture Review Bug Bounty Vulnerability Management Penetration Testing Red Team Python Jira

Information Security Engineer (Mobile)

Visum

Jan 2021 - Jan 2023 (2 years)

Progressed from penetration testing to leading the Mobile Security department, managing specialists and expanding team practices. Conducted web, infrastructure, and mobile security assessments (including black-box testing, source review, and reverse engineering) and established mobile security methodology aligned to OWASP MASVS and OWASP MSTG using Java and Kotlin.

Mobile Application Security Penetration Testing Black Box Testing Reverse Engineering OWASP ASVS Java Kotlin Team Leadership Reporting

Frontend Developer (Full Stack)

Maxima IT

Jan 2020 - Jan 2021 (1 year)

Developed frontend applications with React and expanded into full-stack development with Node.js. Built practical software engineering experience that later informed secure code review and AppSec work.

Frontend Development React Node Full Stack Developer