Security Engineer – Application Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of security for cloud services, APIs, data pipelines, and applications across distributed, edge-deployed systems.

• Lead the efforts in threat modeling and conducting secure design reviews.

• Execute secure code reviews along with whitebox, greybox, and blackbox application security assessments.

• Develop, integrate, and optimize SAST, DAST, SCA, secret-scanning, CodeQL, and other CI/CD security tools.

• Assess, prioritize, and drive the remediation of application vulnerabilities in collaboration with engineering teams.

• Create automation and standardized tools to ensure secure development practices are the norm.

• Provide guidance to engineers and architects as the application security subject-matter expert.

• Establish and enhance the secure software development lifecycle, secure coding standards, and security requirements.

• Manage or assist with vulnerability disclosure and bug bounty initiatives.

• Enhance software supply-chain security, including dependency management, artifact and commit signing, and build/pipeline integrity.

• Collaborate with security operations on incidents related to application layers.

• Offer developer-focused security training and foster a culture of security awareness within engineering teams.

⛳️ Requirements

• 5–8 years of experience in application security, product security, or software engineering with a strong emphasis on security.

• Proficiency in software development using one or more modern programming languages such as Python, Go, Java, JavaScript/TypeScript, Rust, or C/C++.

• Capability to read and analyze production code.

• Experience in evaluating code for vulnerabilities and weaknesses.

• Proven track record in leading threat modeling and security design reviews.

• Practical experience with SAST, DAST, SCA, CodeQL, and CI/CD integration.

• Strong knowledge of OWASP Top 10, CWE, common vulnerability classes, and secure coding practices.

• Experience in securing microservices/SOA, REST/gRPC APIs, containers, and environments such as AWS, Azure, or GCP.

• Experience in conducting black-box and grey-box testing of web applications and APIs.

• Demonstrated ability to drive vulnerability remediation with engineering teams.

• Exceptional written and verbal communication skills.

• Must be a U.S. citizen.

• Bachelor’s degree in Computer Science, Cybersecurity, or equivalent hands-on experience.

• Active U.S. security clearance, or the willingness and eligibility to obtain and maintain one (preferred).

• Preferred industry certifications such as OSCP, OSWE, GWAPT, GWEB, CSSLP, or Burp Suite Certified Practitioner.

• Familiarity with secure-by-default frameworks, software supply chain security, infrastructure-as-code, Kubernetes, bug bounty programs, CVEs, embedded/edge/robotics/IoT software, NIST 800-171, CMMC, or experience in startup/defense/intelligence/critical-infrastructure environments (preferred).

🏝️ Benefits

• Comprehensive medical, dental, and vision coverage.

• Flexible options for remote work.

• Significant autonomy in shaping the secure SDLC, tooling, and standards.

• Opportunities for career advancement in a rapidly growing defense-tech company.

• Work with innovative AI and robotics systems.

• Be part of a mission-driven, fast-paced team.