Staff Application Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Spearhead Apollo’s long-term application security strategy and convert it into collaborative initiatives across teams.

• Provide updates on progress, potential risks, and tradeoffs to Security leadership.

• Influence Engineering, Product, Platform, and Data roadmaps to integrate security efforts from the outset.

• Act as the AppSec representative in decisions that involve multiple departments.

• Establish standards for secure design, code review, and risk modeling, including protocols for AI-generated and agent-generated code.

• Mentor senior engineers and security champions.

• Expand the security champions program and enhance the standards for hiring.

• Oversee security architecture evaluations and threat modeling for complex, high-scale, multi-team systems.

• Define secure-by-default components such as shared authorization, safe OAuth and token management, and SSRF-safe HTTP clients.

• Influence vulnerability management through internal assessments, bug bounty programs, penetration tests, SCA, and runtime findings.

• Investigate root causes, bug categories, and risk-based severity levels.

• Review code across teams, develop exploits, test bypass methods, and lead variant analysis and staged remediation efforts.

• Establish benchmarks for AI-enhanced AppSec practices.

• Leverage AI and agents for code evaluations, threat modeling, triage, and remediation processes.

• Create automation tools utilized by teams beyond the Security department.

• Define security measures for AI systems and agent functionalities, including input/output management, AI-exposed APIs, prompt and response safeguards, tool permissions, and data-exfiltration pathways.

⛳️ Requirements

• Proven experience in leading AppSec strategies across multiple engineering teams, typically with 10+ years in software engineering or application security.

• Proficient in code review, penetration testing, and exploit development.

• Capability to identify design vulnerabilities in unfamiliar codebases and create fixes that resist bypass attempts.

• Strong software development expertise with a track record of delivering production code.

• Experience with Ruby and Ruby on Rails is highly desirable.

• Proficiency in Python is an added advantage.

• Solid understanding of Linux and cloud fundamentals, preferably GCP and Kubernetes.

• Extensive experience in secure architecture and authentication and authorization frameworks.

• Background in developing security components that are adopted by other teams.

• Hands-on experience in securing AI-powered systems or agent functionalities.

• Ability to make difficult risk decisions amidst uncertainty.

• Capability to influence technical and non-technical leaders without formal authority.

• Preferred: security leadership experience for AI-native products, internal agents, or AI-assisted engineering processes at scale.

• Preferred: experience in building or scaling a security champions or developer enablement program.

• Preferred: involvement in public security initiatives such as CVEs, research, presentations, or open-source tools.

• Preferred: OSCP or OSWE certification.

🏝️ Benefits

• Equity

• Company bonus

• 401(k) plan

• Minimum of 10 paid holidays each year

• Flexible PTO

• Parental leave

• Employee assistance program

• Wellbeing benefits

• Global travel coverage

• Life, AD&D, STD, and LTD insurance

• FSA/HSA

• Medical, dental, and vision benefits

• Resources, support, and autonomy for professional development