Senior Security Engineer, Application Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead security initiatives comprehensively across cloud infrastructure hardening and application security.

• Manage technical controls maintained by InfoSec within compliance frameworks such as PCI DSS.

• Implement and optimize infrastructure to safeguard applications against exploitation, account takeover, and denial of service attacks.

• Spearhead security architecture and threat modeling for AI agent products.

• Evaluate RFCs, PRDs, and MRs from a security standpoint and collaborate with product and engineering teams.

• Develop tools and frameworks that facilitate secure development practices for engineers.

• Mentor engineers to enhance recurring incident patterns, address tooling gaps, and reduce process debt.

• Engage in the incident response lifecycle through a 24/7 on-call rotation.

• Assess and incorporate AI-driven tools into InfoSec workflows.

⛳️ Requirements

• Over 5 years of experience in security engineering, covering at least two areas: application security, cloud/infrastructure security, or enterprise security.

• Practical experience with AWS and infrastructure-as-code tools, such as Terraform, CloudFormation, or similar.

• Proficient in reading and contributing to product service code; familiarity with Kotlin, NextJS, Python, Ruby, Scala, or Swift is preferred.

• Strong judgment in build-versus-buy decisions.

• In-depth knowledge of the OWASP Top 10 and its remediation strategies.

• Understanding of OAuth, OIDC, and SAML authentication and authorization standards.

• Experience with LLM/agentic system security, including prompt injection, agent identity, and data exfiltration through AI systems.

• Regular, proficient use of AI-assisted coding/security tools, with the ability to guide and verify AI outputs.

• Excellent written communication skills for threat models, design documents, and merge-request feedback.

• Comfortable navigating the technical aspects of compliance frameworks such as PCI or SOX; familiarity with vulnerability scanning, control reviews, and tamper detection is preferred.

• Practical experience with static analysis tools like Snyk, Veracode, or Fortify; infrastructure vulnerability scanning tools such as Qualys, Tenable, or Rapid7; and penetration testing tools like BurpSuite or OWASP ZAP is preferred.

• Experience with containers and Kubernetes is preferred.

🏝️ Benefits

• Competitive year-end performance bonus.

• Equity package.

• Comprehensive medical, dental, and vision coverage.

• Flexible vacation policy.

• Pet discount plans.

• Retirement plan with company match (401K).