Senior Application Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership and drive the continuous enhancement of Apollo’s secure software development lifecycle.

• Conduct application security evaluations, threat modeling, and in-depth code analysis for product, platform, and AI functionalities.

• Offer security architecture guidance to Engineering, Product, and IT teams.

• Establish and uphold application-security guardrails, secure design expectations, code review standards, and risk models.

• Lead vulnerability management through internal assessments, bug bounty programs, penetration tests, software composition analysis/runtime findings, and other research signals.

• Assess, prioritize, route, track, resolve, and validate security findings within service level agreements (SLAs).

• Analyze code, identify root causes, suggest solutions, and implement or assist in remediation efforts.

• Execute offensive security testing, exploit development, bypass testing, adversarial analysis, and red-team-style exercises.

• Configure and enhance application security tools, SAST integrations, dashboards, and controls.

• Develop or refine security tools, automations, and workflow improvements.

• Leverage AI to streamline and scale security and engineering-adjacent processes.

• Integrate AI-specific security checks into secure software development lifecycle reviews and code assessments.

• Collaborate on AI security requirements and controls.

• Facilitate security enablement for engineers and security advocates.

• Provide guidance for remediation, secure patterns, and illustrative examples.

• Work in partnership with Engineering, Product, Platform, Data, Legal, and security teams.

• Generate documentation, metrics, and written narratives to enhance AppSec visibility and inform decision-making.

• Manage semi-annual or annual AppSec objectives and promote cross-team operational enhancements.

⛳️ Requirements

• A minimum of 5 years of experience in software engineering or application security.

• Significant hands-on depth in application security within modern SaaS environments.

• Proficiency in reading, writing, and delivering production code.

• Experience with Ruby is highly desirable; familiarity with Python or similar scripting languages is a plus.

• Strong fundamentals in Linux and cloud environments, ideally with GCP backing.

• Extensive knowledge of common application security challenges, secure design principles, authentication and authorization methodologies, vulnerability management, and developer security tools.

• Proven experience in deep code reviews, penetration testing, exploit-oriented validation, vulnerability remediation, bypass attempts, and variant analysis.

• Experience managing findings from bug bounty programs, penetration tests, internal evaluations, or automated security tools through to closure and verification.

• Familiarity with AI-assisted tools, automations, APIs, or structured workflows to enhance engineering or security processes at scale.

• Experience in securing AI-powered systems or features.

• Excellent written and verbal communication skills, with strong stakeholder management and influencing capabilities.

• Relevant security certifications are an advantage.

🏝️ Benefits

• Equity

• Company bonus

• 401(k) plan

• Minimum of 10 paid holidays each year

• Flexible PTO

• Parental leave

• Employee assistance program

• Wellbeing benefits

• Global travel coverage

• Life/AD&D/STD/LTD insurance

• FSA/HSA

• Medical, dental, and vision benefits

• Resources, support, and independence for professional development