C
Senior Application Security Engineer
Not specifiedFull-timeSecurity EngineeringCybersecurity
Lead technical workstreams in an application security program, partnering with R&D to build security into product design, development, and delivery. Develop automation and AI-assisted workflows, strengthen security guardrails, and mentor engineers.
Responsibilities
- Review high-risk code and designs, and help engineers address root causes.
- Build and tune CI/CD security checks, including static and dynamic analysis, dependency and container scanning, and secrets detection.
- Triage and prioritize vulnerabilities by risk, coordinate remediation with engineering owners, and track progress against service levels.
- Improve visibility and control of third-party and open-source dependencies, including SBOM generation and accuracy.
- Develop automation and AI-assisted workflows for triage, code review, and reporting.
- Partner with offensive security teams, perform penetration tests, and turn findings into fixes and improved standards.
- Support product security incident response by analyzing reported vulnerabilities, assessing impact, and helping teams deliver and communicate fixes.
- Contribute to secure coding standards, engineering guardrails, and developer enablement through training and office hours.
- Mentor security engineers and lead cross-R&D workstreams and projects.
- Design and operate AI agents for application security tasks, with defined guardrails, human approval, evaluation, and auditability; measure their impact on risk and review capacity.
Requirements
- At least 6 years of experience in cybersecurity, security engineering, or software engineering, including at least 4 years in application or product security.
- Strong knowledge of vulnerability classes, secure design, threat modeling, and authentication and authorization for cloud-native, API-driven applications.
- Strong programming skills in at least one of Python, Go, Java, or TypeScript, with the ability to review code for security issues.
- Hands-on experience with SAST, SCA, DAST, and secrets scanning tools, including CI/CD integration.
- Working knowledge of at least one major cloud provider and container security.
- Demonstrated ability to influence engineering teams and get security work prioritized and completed.
- Experience mentoring or developing other engineers.
- Clear written and verbal communication with engineering, product, and senior leadership teams.
Nice to have
- Experience securing LLM features and agent systems, including prompt injection and data exposure risks.
- Penetration testing, vulnerability research, or bug bounty experience.
- Experience with SBOM tools, dependency management, and build integrity.
- Familiarity with Terraform, Kubernetes security, and cloud posture tools.
- OSCP, CSSLP, GIAC, or similar certification.