Senior Security Engineer – App Sec

This is a fully remote position, open to applicants in United States, +40 more locations.

📋 Description

• Provide guidance to developers on secure design principles.

• Conduct reviews of code and architecture prior to release.

• Develop and deploy code to address vulnerabilities and strengthen systems.

• Take ownership of vulnerability remediation throughout engineering and uphold remediation service level agreements (SLAs).

• Collaborate with developers on security concerning dependencies and the software supply chain.

• Lead the response and hands-on remediation for critical vulnerabilities in third-party packages.

• Create security tools and automation for effective detection, triage, and remediation.

• Identify and address cloud vulnerabilities across AWS environments and Terraform-managed infrastructure.

• Facilitate threat modeling sessions with engineering teams.

• Keep abreast of emerging threats related to applications, code, and AI security.

• Offer proactive remediation advice to engineering teams.

• Mentor engineers on secure coding practices and encourage a security-first mindset.

• Enhance observability, automate repetitive security tasks, and proactively strengthen applications and AWS infrastructure.

⛳️ Requirements

• A minimum of 5 years of experience in software engineering or security engineering.

• At least 1 year of experience with a focus on security.

• Proficient hands-on experience in at least one backend programming language.

• Capability to write and deploy production code fixes.

• Ruby is strongly preferred.

• Practical experience with SAST/DAST tools integrated into CI/CD pipelines.

• Experience in driving vulnerability remediation at scale, including addressing dependency and supply chain vulnerabilities.

• Familiarity with tools such as GitHub Advanced Security.

• Experience conducting secure code reviews, architecture assessments, and threat modeling.

• Hands-on experience in securing AWS environments, including IAM, VPCs, and WAF.

• Experience remediating infrastructure-as-code using Terraform.

• Ability to clearly articulate security concepts, risks, and trade-offs to both technical and non-technical audiences.

• Must be able to live and work full-time in one of the eligible U.S. states or reside in Ontario for remote technical positions in Canada.

🏝️ Benefits

• Company equity through Restricted Stock Units (RSUs).

• 401(k) plan with a company match up to 4% of eligible earnings.

• Multiple options for medical plans.

• Coverage for dental and vision.

• Contributions to Health Savings Accounts (HSA) funded by the company.

• Company-paid life insurance and short-term disability coverage.

• Additional long-term disability, critical illness, accident, legal, and pet insurance.

• Support for mental health and access to confidential counseling resources.

• Flexible Paid Time Off (PTO) for exempt employees, with most employees taking 15–20 days per year.

• Eight holidays observed by the company.

• Paid parental leave, including up to 14 weeks at 100% pay for birthing parents and 8 weeks at 100% pay for non-birthing parents.

• Opportunities for career mobility and internal growth.

• Budget for professional development aimed at certifications, conferences, and learning, subject to management approval.

• A remote-first work arrangement.

• Timely updates and feedback following interviews.

• Skills assessment relevant to the position, if applicable.

• Genuine, thoughtful human interaction throughout the hiring process.