Senior Application Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Manage the application security program for customer-facing B2B products, ensuring security is integrated into planning, development, and release processes.

• Implement and oversee automated SAST, DAST, and SCA testing within CI/CD pipelines.

• Set up and maintain AppSec tools and the vulnerability management platform.

• Ensure that findings are systematically collected, deduplicated, and tracked across various products and repositories.

• Prioritize vulnerabilities based on their severity, known exploitation, reachability, and business impact.

• Collaborate with Engineering and TechOps to drive remediation efforts within agreed timelines.

• Conduct security architecture and design reviews, as well as threat modeling for new products and features, including the API program.

• Automate and orchestrate AppSec workflows utilizing the Anthropic Claude API, OpenAI, or similar LLM providers, ensuring validation and guardrails are in place.

• Evaluate AI-enabled product features and workflows for prompt injection, data leakage, and model misuse.

• Develop and uphold secure coding standards and provide technical guidance.

• Support data protection initiatives by implementing encryption, managing secrets, and phasing out weak ciphers and outdated protocols.

• Monitor product security risks, exceptions, and risk acceptances, contributing to the InfoSec risk register and assessments.

• Participate in incident response for product security events and engage in incident simulation exercises.

• Generate and report AppSec metrics for InfoSec KPIs, KRIs, and executive reporting.

• Provide technical evidence for audits, customer security assessments, and compliance requirements.

• Mentor developers and offer secure development guidance.

• Stay updated on emerging threats, application security practices, and AI-related security and privacy issues.

⛳️ Requirements

• Over 5 years of experience in application and/or product security.

• Practical experience in implementing and operating SAST, DAST, and SCA tools within CI/CD pipelines.

• Proficient in triaging and prioritizing vulnerabilities by severity, known exploitation, reachability, and business impact, and facilitating their remediation.

• Capability to review code and provide remediation advice in .NET/C#.

• Experience in conducting threat modeling and security architecture and design reviews.

• Familiarity with secure API design, OAuth/OIDC and JWT handling, secrets management, and encryption fundamentals.

• Strong knowledge of OWASP Top 10s, ASVS, and Proactive Controls, with the ability to translate findings into business risks.

• Scripting or programming skills (e.g., Python, PowerShell, C#) to automate security workflows and integrate tools via APIs.

• Excellent communication skills with both technical and non-technical audiences, capable of influencing engineering teams without direct authority.

• Experience utilizing LLM APIs like Claude or Copilot to automate AppSec tasks (preferred).

• Familiarity with assessing AI-enabled features for prompt injection, data leakage, and model misuse (preferred).

• Experience with Azure DevOps, DefectDojo, and common open-source security scanners (preferred).

• Expertise in securing Azure-hosted environments, including IaC, containers, and secrets scanning (preferred).

• Basic knowledge of C++ and Angular (preferred).

• Experience in manual web and API penetration testing, particularly for access control and multi-tenant isolation (preferred).

• Background in B2B SaaS, multi-tenant platforms, or supply chain/EDI environments (preferred).

• Experience in supporting security incident response (preferred).

• Proficient in providing evidence for audits such as SOC 2, ISO 27001, PCI, and customer security assessments (preferred).

• Relevant certifications such as OSWE, GWEB, CSSLP, or AZ-500 (preferred).

• Applicants must have authorization to work for any employer in the U.S.

• TrueCommerce cannot sponsor or assume sponsorship of an employment visa for this position.

🏝️ Benefits

• Competitive benefits package.

• Generous paid time off offerings.

• Flexible and casual work environment.

• Opportunities for career development.

• Recognition programs.

• 401k plan with a 3.5% company match, vested after 2 years.

• 20 PTO days.

• 10 company holidays.

• 1 day off for your birthday.

• 1 volunteer day.

• 3 summer days.

• Comprehensive medical, dental, vision, and other life/health insurance plans.

• Paid parental leave.

• Wellness reimbursement program.

• Remote-first and casual work setting.