Senior Application Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Triage, validate, route, and facilitate remediation of findings from SAST, DAST, SCA, code reviews, penetration tests, and bug bounty programs.

• Develop automation solutions to eliminate manual tasks within vulnerability management workflows.

• Define the scope for external penetration tests and bug bounty initiatives, guide testers, assess severity, and ensure closure of findings.

• Identify trends across findings and address root causes.

• Implement secure patterns and defaults.

• Create custom static analysis rules to address organizational anti-patterns.

• Evaluate platform-layer controls, including authorization, service identity, secrets management, and gateway enforcement.

• Collaborate with engineering teams to remediate security vulnerabilities.

• Conduct hands-on application and API testing along with manual code reviews for high-exposure services.

• Engage in threat modeling for new and high-exposure designs.

• Provide security enablement across engineering, including a security champions initiative.

⛳️ Requirements

• Proven experience managing vulnerability processes end-to-end, including automation using code with scanners, ticketing systems, and source-control APIs.

• Experience shipping and maintaining real software; capable of quickly reading unfamiliar code, thoroughly reviewing it, and understanding architecture and failure modes.

• Take ownership of issues through to remediation, including addressing dependencies on other teams.

• Proficient in code auditing in at least one of the following languages: Go, Python, Node.js, Ruby, or Java, with a willingness to work in others.

• Strong understanding of the OWASP Top 10, with particular expertise in broken access control and business logic vulnerabilities.

• Familiarity with SAST, DAST, and SCA integrated into CI/CD workflows.

• Basic knowledge of cloud fundamentals on GCP or AWS.

• Experience with Docker and Kubernetes.

• Ability to differentiate between genuine findings and theoretical issues.

• Capability to influence stakeholders asynchronously across different time zones without a direct reporting line.

• Advanced offensive certifications such as OSWE, BSCP, CPTS, or CRTO are considered a plus.

🏝️ Benefits

• Competitive compensation package comprising cash and equity.

• Early exercise opportunity for all options, including those that are pre-vested.

• Flexible remote work culture allowing you to work from anywhere.

• Flexible paid time off along with a year-end break.

• Health, dental, and vision insurance coverage for employees and their dependents—specific to the US and Canada.

• 4% matching contribution in 401k / RRSP—specific to the US and Canada.

• A MacBook Pro delivered directly to your residence.

• One-time stipend for home office setup, including desk, chair, screen, etc.

• Monthly meal stipend provided.

• Monthly stipend for social meet-ups.

• Annual health and wellness stipend.

• Annual learning stipend for professional development.