Senior Security Engineer – Application Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee the creation and execution of comprehensive application security protocols throughout the complete Software Development Lifecycle (SDLC)

• Collaborate with engineering teams to embed security within architecture, design, development, testing, and deployment processes

• Conduct hands-on security assessments of web applications, APIs, cloud-native services, and associated infrastructure

• Develop and enhance automated security testing within CI/CD pipelines, encompassing static analysis, dependency scanning, secrets detection, container scanning, and dynamic testing

• Assess application security tools, enhance the quality of tooling outputs, and minimize unnecessary findings and friction for developers

• Create secure coding standards accompanied by developer-centric documentation

• Provide application security expertise for vulnerability management, security incidents/investigations, and post-incident evaluations

• Review third-party applications, libraries, APIs, and integrations for potential security risks

• Ensure compliance with relevant healthcare regulatory and compliance mandates, including HIPAA and GDPR, across all product lines and systems

• Investigate, collaborate on, and implement cutting-edge technology

⛳️ Requirements

• 4+ years of professional experience in application, product, or software security, operating as an individual contributor, or as a software engineer who has transitioned into security

• In-depth understanding of application security vulnerabilities and attack methodologies, including the OWASP Top 10 and API security threats

• Proven experience in manual security testing of contemporary web applications, APIs, and distributed systems

• Capability to analyze application architecture and source code for security vulnerabilities

• Experience in integrating application security tools within modern CI/CD workflows

• Familiarity with static application security testing, dynamic testing, secrets detection, container security, and infrastructure-as-code scanning

• Knowledge of authentication, authorization, session management, cryptography, secrets management, and secure API design

• Strong proficiency in cloud technologies (AWS, GCP, or Azure), modern programming languages, and the security implications of utilizing generative coding utilities and AI code development tools

• Proven track record of researching, establishing, and successfully implementing enterprise-wide security policies and guidelines

• Experience with specific tools and technologies used by K, including Datadog, Sumologic, Torq, flare.io, GCP, Entitle, Okta, Orca, GitLab, and Prisma is a plus

🏝️ Benefits

• Monthly social committees for company events

• 18 vacation days, 9 company holidays, 5 sick days, and 2 personal days

• Stock options for every full-time employee

• Paid parental leave

• 401k benefits

• Commuter benefits

• Competitive health, dental, and vision insurance options