Senior Application Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Spearhead security initiatives throughout the software development lifecycle and enhance development practices via scalable automation.

• Conduct and guide threat modeling and establish security requirements early in the design phases.

• Collaborate with developers, architects, and product managers to harmonize business objectives with security requirements.

• Oversee security architecture and code evaluations for distributed systems.

• Execute hands-on testing to uncover risks and drive remediation efforts alongside vulnerability and incident response teams.

• Propel the Product Security strategy through cross-functional initiatives and cultural influence.

• Balance business and security risks by offering technically sound, pragmatic recommendations.

• Convert lessons learned into reusable organizational assets to enhance the overall security posture.

• Mentor engineers and practitioners, fostering secure-by-default thinking and shared accountability.

• Exhibit proactive leadership by coordinating teams to achieve measurable security and business outcomes.

⛳️ Requirements

• Over 7 years of experience in information security and at least 3 years in software development.

• Bachelor’s degree or equivalent in Computer Science, Information Security, or a related field.

• Strong communication and leadership skills; able to influence both technical and non-technical stakeholders, including management.

• Committed and proactive in identifying opportunities and independently leading initiatives.

• Comprehensive understanding of enterprise and cloud-native architectures and their secure design principles.

• Proficiency in network and web protocols (TCP/IP, TLS, HTTPS, OAuth 2.0, OpenID Connect) as well as common attack vectors.

• Demonstrated expertise in guiding security development and code evaluations, providing actionable, risk-based recommendations.

• Proficient in several programming languages (e.g., Java, C/C++, JavaScript, Python) and in mitigating vulnerabilities such as those listed in the OWASP Top 10.

• Experience in integrating SAST, DAST, and dependency scanning within CI/CD pipelines.

• Familiarity with Agile, DevOps, and contemporary delivery practices.

• Practical experience with cloud technologies (AWS, Azure, GCP, Kubernetes, service mesh, CDN), including secure configuration and identity management.

• Strong analytical and problem-solving abilities, viewing challenges from an attacker's perspective.

• Background in penetration testing, automated testing, or testing frameworks (JUnit, pytest, REST Assured, Playwright).

• Security certifications are preferred (GIAC, OSCP, CEH, CISSP, CCSP, or equivalent).

🏝️ Benefits

• Medical insurance

• Dental insurance

• Vision insurance

• Matching 401(k)

• Paid time off

• Wellness program

• Employee discounts on Sony products

• Potential eligibility for a bonus package

• Flexible role with options for remote work