Senior Application Security Engineer
New
B
BioRenderApplication security
Location: Remote (Canada)
Secondary Locations: Remote (US)Full-TimeSenior
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Required Skills
- AWSNode.jsPythonReactTerraform
Requirements
- Demonstrate software engineering ability, including fluency reading code and writing production-quality code.
- Have contributed to real codebases, including Node.js/React; Python is a plus.
- Be fluent using AI coding assistants and agentic workflows, and understand the security risks they introduce.
- Have expertise in web application security and secure-coding best practices.
- Have experience integrating and maintaining SAST/DAST systems within CI/CD and with Secure Software Development Lifecycles.
- Have hands-on experience securing AWS cloud workloads.
- Be comfortable with infrastructure-as-code such as Terraform or an equivalent.
- Have threat-modeling experience and command of common code and network vulnerability types, their impact, and remediation.
- Have applied knowledge of cryptography, PKI, and TLS and their practical implementation.
- Experience with Cloudflare is a plus.
- Experience hardening production LLM-integrated or AI-powered features, operating a bug bounty program, or contributing to SOC 2 control design and audit readiness is a plus.
Responsibilities
- Contribute production-quality code to the Node.js/React application and Python/Terraform infrastructure.
- Build and maintain security and CI/CD tooling that automates security workflows.
- Review RFCs and design documents and pair with engineers to resolve security issues.
- Define secure-by-design patterns and standards for authentication, authorization, and API security.
- Lead threat modeling and turn identified risks into shipped controls.
- Own and evolve Secure SDLC and CI/CD security integrations for SAST, DAST, SCA, and secrets.
- Use AI coding assistants and agentic tooling for code review, triage, and tooling development.
- Secure AI-integrated product features against prompt injection, data leakage, and over-scoped access.
- Perform penetration testing and Node.js/React code reviews using OWASP methodology.
- Evaluate, reproduce, and close bug bounty findings by shipping fixes.
View Full Description & ApplyYou'll be redirected to the employer's site
