Staff Application Security Engineer
New
F
FingerprintFraud detection
This role is open across the United States and can be based anywhere our team members work from.Full-TimeStaff
Salary177,000 - 240,000 USD per year
Apply NowOpens the employer's application page
Job Details
- Experience
- 8+ years in software engineering and/or security engineering, with 5+ years focused on application security
- Required Skills
- PythonGoCI/CD
Requirements
- Have 8+ years in software engineering and/or security engineering, including 5+ years focused on application security.
- Write production-quality code in TypeScript/JavaScript, Go, Python, or a similar language.
- Understand modern web and API architectures and work comfortably in engineering repositories and CI/CD pipelines.
- Bring practical expertise in OWASP Top 10, authentication and authorization, API security, injection, SSRF, cryptography misuse, business-logic flaws, and abuse flaws.
- Have led design-time security reviews for complex systems and produced threat models used by engineers.
- Have deployed and tuned SAST, DAST, SCA, and secrets-detection tooling in CI/CD.
- Have used AI-assisted code analysis, triage, or auto-remediation in a real security program and use AI agents in daily security work.
- Have owned vulnerability triage, severity rating, remediation tracking, and penetration-test programs with SLAs.
- Have a track record of improving security outcomes across engineering teams through partnership and tooling.
- Write precise findings and design feedback and explain technical risk to engineers, leadership, and customer security teams.
Responsibilities
- Design and build the secure development lifecycle, including security requirements, threat modeling, secure code review, and pre-release testing.
- Operate SAST, DAST, SCA, secrets detection, and container and IaC scanning tools integrated with CI/CD.
- Build AI-assisted security triage, remediation, review agents, and testing, and determine what they can block, flag, or fix.
- Create secure defaults, hardened libraries and frameworks, reusable security patterns, CI integrations, and automation.
- Lead threat modeling and architecture security reviews across the API, web and mobile SDKs, dashboard, and data pipeline.
- Triage, risk-rate, and drive remediation of findings from scanners, penetration tests, bug bounty, and customer reports.
- Perform hands-on security testing for authentication and authorization, API, injection, SSRF, business-logic, and abuse-path issues.
- Lead application-layer security incident investigation, containment, root cause analysis, and remediation.
- Partner with engineering teams through design consultations, secure coding guidance, training, and a Security Champions program.
- Support customer security conversations and vendor security assessments with technical expertise.
View Full Description & ApplyYou'll be redirected to the employer's site
