Application Security Engineer (Source Code Review)

Role overview Conduct security reviews of web, mobile, and backend code by combining static analysis with hands-on investigation. You will examine defined repository scopes, explain actionable risks to engineering teams, and verify that reported issues are fixed.

Responsibilities - Triage static analysis results and remove false positives before reporting. - Review authentication, authorization, input handling, cryptography, secrets management, and third-party dependencies. - Trace data flows across services to uncover flaws that emerge from interactions between components. - Document findings with file and line references, safe evidence of exploitability, and remediation examples where useful. - Retest fixes and update reports.

Requirements - At least four years of combined software engineering and application security experience, including regular production code review. - Ability to read code in at least three of these language groups: JavaScript or TypeScript, Python, Java or Kotlin, C#, Go, PHP, Ruby, or Swift. - Based in the United States and authorized to work there; client work follows US time zones. - Strong reporting skills, with evidence useful to both engineers implementing fixes and auditors reviewing them; a redacted sample report is required with the application. - Able to work within a written scope, identify scope problems early, and provide two professional references familiar with live engagements.

Nice to have - Experience using static application security testing tools at scale or reviewing AI-generated code. - Experience with iOS or Android codebases, infrastructure as code, or open-source security tooling.

Benefits and work setup This is a full-time, remote role within the United States. Reviews typically cover a defined set of repositories over four to eight days, followed by retesting.