Senior Application Security Engineer

Role overview Set the direction for application security and put it into practice across the software development lifecycle. This hands-on senior role spans vulnerability management, secure engineering, architecture review, automation, and incident response, in close partnership with engineering, DevOps, and IT teams.

Responsibilities - Build and improve vulnerability management, from triage and prioritization through remediation tracking and risk reporting. - Integrate repeatable security checks into development and deployment workflows, and automate routine patching or dependency updates. - Lead threat modeling, architecture and design reviews, and third-party penetration tests; coordinate remediation of findings. - Define the application security roadmap, secure coding standards, and requirements for new services. - Lead cross-team security improvements, mentor engineers, and grow a security champions program. - Select and manage security tools, report program metrics and risks to technical and executive audiences, and contribute to on-call response and post-incident reviews. - Apply AI-assisted tools and build agents to support threat hunting, vulnerability triage, and testing of code and infrastructure.

Requirements - 6–8+ years in application security, product security, or security-focused software engineering. - Strong coding skills in a modern web or backend language, sufficient to review unfamiliar code, create automation, and recommend fixes. - Experience building or scaling vulnerability management and remediation processes. - Practical experience integrating and tuning CI/CD security tools, such as static and dynamic analysis, dependency, secrets, or infrastructure-as-code scanning. - Ability to lead security initiatives from planning through rollout, mentor engineers, and explain risk and tradeoffs clearly. - Deep expertise in an area such as identity and access management, cryptography, API security, or cloud-native application security; familiarity with AI security tools and their limitations.

Nice to have - Cloud security experience, particularly with GCP; blockchain or Web3 security experience. - Familiarity with regulated financial services requirements such as SOC 2, PCI DSS, or GLBA.

Benefits and work setup - US base salary range of $112,320–$168,480 per year, a 25% annual bonus target paid quarterly, and equity in the form of RSUs. Compensation depends on experience, skills, location, internal equity, and business needs. - Medical, dental, and vision plans; some plans have fully employer-paid premiums for employees and dependents. Other offerings include HSA, FSA, dependent care FSA, 401(k), commuter benefits, and employer-paid life and disability coverage. - 11 observed holidays, paid time off, up to 12 weeks of paid family leave, and continuing education reimbursement. - The role is remote. Work visa sponsorship is not available.