Senior Application Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Collaborate with product teams, engineering leaders, and architects to promote secure design and implementation practices.

• Drive effective threat modeling efforts and convert risk assessments into actionable engineering strategies.

• Conduct manual code reviews, design assessments, and security evaluations.

• Manage the vulnerability lifecycle utilizing SAST, SCA, DAST, and secret-scanning tools.

• Optimize and sustain security tools within delivery pipelines and developer workflows.

• Develop autonomous tools for vulnerability triage, deduplication, exploitability enhancement, and remediation guidance.

• Define and validate safeguards for AI-assisted and agent-generated code.

• Replicate vulnerabilities, guide remediation, and verify fixes with engineering teams.

• Advocate for security in architectural decisions while articulating technical risks and trade-offs.

• Provide mentorship to teammates and engineering security advocates.

• Assist with penetration testing outcomes, bug bounty triage, and security incidents.

• Enhance application security to be more scalable, measurable, and beneficial for developers.

⛳️ Requirements

• Extensive experience in application or product security, with a proven history of collaboration with software engineering teams.

• In-depth practical expertise in threat modeling and manual code reviews for web and microservice architectures.

• Strong comprehension of authorization, multi-tenant isolation, and business-logic vulnerabilities.

• Hands-on experience with application security tools for source code analysis, dependency analysis, dynamic testing, and secret detection.

• Background in configuring, tuning, integrating security tools within pipelines, and managing finding triage.

• Technical acumen to differentiate between noisy security alerts and exploitable risks, clearly communicating remediation strategies.

• Experience in developing automation or engineering tools for vulnerability management.

• Practical knowledge of security risks associated with large language models and agentic applications, including prompt injection, unauthorized tool usage, and potential data exfiltration paths.

• Proficiency in at least one modern cloud-native programming language; familiarity with Kotlin and JavaScript/TypeScript and the ability to interpret unfamiliar code.

• Working familiarity with Amazon Web Services, Kubernetes, containers, and infrastructure as code.

• Preferred expertise in securing agentic applications, Model Context Protocol integrations, identity and authorization in multi-tenant SaaS environments, or transactional and financial systems.

• Must possess a valid right to work in the United States.

• Successful applicants will need to undergo pre-employment ID verification, reference checks, and qualification assessments.

🏝️ Benefits

• 401(k) with Company Match

• Medical, Dental & Vision Coverage

• Employee Assistance Program (EAP)

• Employer-Paid Life, AD&D, Short-Term Disability & Long-Term Disability Insurance

• Flexible Open PTO

• Paid Sick Leave

• Paid Parental Leave

• RTD EcoPass (for eligible Colorado-based employees)

• Internal development hub

• Learning & Development trainers

• AI powered tools

• Mentorship from experienced cloud professionals

• Opportunities for cross-continent collaboration

• Career growth and advancement opportunities