Sr. Application Security Engineer

Role overview Help protect applications throughout the software development lifecycle by finding security weaknesses, guiding engineering teams toward safer implementations, and embedding security checks into delivery workflows. The role includes application assessments, secure code review, vulnerability remediation support, and API security, with particular attention to GraphQL. It is remote and operates within established security and compliance frameworks.

Responsibilities - Assess applications with static, dynamic, and dependency analysis tools to identify vulnerabilities. - Review code and provide practical secure coding guidance to developers. - Configure and maintain code scanning and secret scanning capabilities in GitHub Advanced Security. - Triage findings with engineering teams and help drive remediation. - Integrate security checks and automation into CI/CD workflows. - Review API implementations, especially GraphQL, and maintain security documentation.

Requirements - Bachelor’s degree in computer science, cybersecurity, information technology, or a related field. - Five to eight years of experience in application security or a related security discipline. - Hands-on coding experience and ability to review code across multiple languages. - Professional experience with SAST, DAST, and SCA tools, including GitHub Advanced Security. - Strong knowledge of the OWASP Top 10 and secure development practices. - Clear communication skills for explaining security findings to technical and nontechnical partners.

Nice to have - Experience configuring Cloudflare WAF or bot management, or automating security tasks with Python, Go, or similar languages. - Contributions to security research, tools, or presentations; experience in healthcare or another regulated industry. - Familiarity with AWS, multi-cloud environments, Jenkins, GitHub Actions, or comparable CI/CD tools.

Benefits and work setup - Remote role. The work follows security and compliance frameworks including NIST CSF, NIST 800-53, SOC 2, and PCI DSS. - Full-time compensation may include salary and equity, along with health, dental, vision, and parental leave benefits, retirement matching, employee stock purchase, flexible time off, company holidays, mental health days, and team retreats.