Senior Security Engineer, Application Security

Role overview

Lead security engineering across application and cloud environments, helping product teams build secure services and AI-agent features from the design stage onward. The work spans architecture, hands-on controls, developer tooling, compliance, and incident response, with opportunities to improve how engineers handle recurring security risks. This is a remote role aligned to Eastern or Central time zones and includes a 24/7 on-call rotation.

Responsibilities

- Own security initiatives across cloud hardening and application security, including projects with unclear requirements and multi-sprint scope. - Maintain technical controls for frameworks such as PCI DSS, including scanning, network-control reviews, and tamper detection. - Deploy and tune protections against exploitation, account takeover, and denial-of-service attacks. - Threat-model AI agents with access to calendars or accounts, and advise on risks such as prompt injection and data exposure. - Review technical and product designs with engineering teams, and help shape security during development of AI-enabled features. - Build tools and reusable frameworks that make secure development easier; mentor engineers and address recurring incidents or process gaps. - Join incident response and evaluate AI tools for security team workflows.

Requirements

- At least five years in security engineering, covering at least two of application security, cloud or infrastructure security, and enterprise security. - Hands-on AWS and infrastructure-as-code experience, and the ability to read and contribute to service code. - Familiarity with the OWASP Top 10 and practical remediation, plus authentication and authorization standards such as OAuth, OIDC, and SAML. - Strong written communication for threat models and feedback on designs and code changes. - Fluent use of AI-assisted coding or security tools, with a concrete method for directing and verifying their output. - Sound judgment about when to buy, build, extend, or replace security tooling.

Nice to have

- Experience with static analysis, infrastructure vulnerability scanning, or penetration-testing tools; container and Kubernetes security; AI-agent security; or technical controls for PCI, SOX, or similar frameworks.

Benefits and work setup

- Remote work, with applicants expected to align with Eastern or Central time zones. - Salary range of $150,000–$225,000, with eligibility for a year-end bonus and equity. - Medical, dental, and vision coverage, flexible vacation, a retirement plan with employer match, and pet discount plans.