AppSec Engineer

Role overview Build and operate security capabilities across application security, identity, cloud and SaaS environments, incident response, and compliance. The work combines day-to-day security operations with creating new detection, automation, and response processes. You’ll partner across engineering and business teams, with an expectation that AI tools support practical security work.

Responsibilities - Assess application vulnerabilities, conduct internal penetration testing, and help teams adopt secure development practices. - Build and maintain security checks in delivery pipelines, including code, dependency, secret, and application scanning. - Manage identity and access controls, review connected applications and permissions, and improve access request processes. - Triage incidents and phishing reports, analyze logs, coordinate containment, and develop automated detections and response playbooks. - Secure cloud, collaboration, and endpoint environments; contribute security guidance during design and integration work. - Support security audits and risk management, coordinate testing and remediation, and run awareness activities such as simulations and exercises.

Requirements - Three or more years in security engineering, security operations, or a related role. - Hands-on incident response and log analysis experience; familiarity with a SIEM and writing detection rules. - Strong identity and access management skills, including SSO, SAML, and multifactor authentication. - Experience securing cloud or SaaS environments, plus scripting ability and comfort working with APIs. - Working knowledge of SOC 2 or ISO 27001, and practical daily use of AI assistants or coding agents. - Fluent English and the ability to move security work forward across teams.

Nice to have - Experience with security compliance tooling, observability platforms, data warehouses, code hosting platforms, or threat hunting.

Benefits and work setup - Broad ownership with the opportunity to design and put new security processes into production. The role spans operations and capability building across a distributed, around-the-clock business.