Staff Application Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Design and implement Fingerprint's secure development lifecycle, which encompasses security requirements, threat modeling, secure code review, and pre-release security testing.

• Take ownership of and manage SAST, DAST, SCA/dependency scanning, secrets detection, and container/IaC scanning within CI/CD pipelines.

• Develop AI-first security tools for triage, auto-remediation, security review agents, and AI-enhanced testing.

• Establish secure defaults, create hardened libraries and frameworks, and develop reusable security patterns.

• Write code, develop security libraries, create CI integrations, and automate processes in engineering repositories.

• Lead threat modeling sessions and architecture security reviews for APIs, web/mobile SDKs, dashboards, and data pipelines.

• Manage vulnerability processes, including triage, risk assessment, remediation, and adherence to SLAs.

• Collaborate with the Compliance team on penetration testing, retesting, and remediation efforts.

• Conduct hands-on security testing for authentication, authorization, APIs, injection vulnerabilities, SSRF, business logic, and abuse pathways.

• Oversee application-layer security incident investigations, including containment, root cause analysis, and remediation efforts.

• Define application security logging and alerting in collaboration with Cloud Platform and engineering teams.

• Support engineering teams through office hours, design consultations, secure coding guidance, and the Security Champions program.

• Create and deliver secure coding training; mentor engineers through code reviews and design feedback sessions.

• Partner with the Senior Manager of Application Security to define the roadmap and oversee technical execution.

• Provide engineering evidence for security controls and assist in enterprise customer security discussions and vendor assessments.

⛳️ Requirements

• Over 8 years of experience in software engineering and/or security engineering, with at least 5 years focused specifically on application security.

• Proficient in production-quality coding in TypeScript/JavaScript, Go, Python, or equivalent programming languages.

• Familiarity with modern web and API architectures.

• Extensive practical AppSec knowledge, covering OWASP Top 10, authentication and authorization, API security, injection vulnerabilities, SSRF, cryptography issues, business logic, and abuse flaws.

• Proven experience leading threat modeling and security reviews during the design phase for complex systems.

• Experience with deploying and fine-tuning SAST/DAST/SCA/secrets-detection tools in CI/CD environments.

• Hands-on experience with AI-assisted code analysis, triage, or auto-remediation within a live program; daily utilization of AI agents.

• Ownership of vulnerability management processes, including triage, severity rating, remediation tracking, and penetration testing programs with SLAs.

• Demonstrated ability to influence engineering teams without direct authority.

• Strong written and verbal communication skills regarding technical risks.

• Must be authorized to work from the specified home location.

• Nice-to-have: Experience in fraud detection, bot mitigation, identity, or device intelligence.

• Nice-to-have: Knowledge of AWS cloud security, Wiz or equivalent CSPM, client-side/mobile SDK security, multi-tenant SaaS, bug bounty operations, AI/ML security, autonomous or AI-augmented penetration testing, security certifications, published research/CVEs/open-source contributions, and familiarity with SOC 2/ISO 27001 controls.

🏝️ Benefits

• 100% remote work.

• Join a globally distributed, remote-first team.

• Work in an inclusive environment.

• Opportunity to shape a dedicated AppSec function from its inception.

• Enjoy staff-level scope and autonomy.

• Access to a modern security stack and tools, including Snyk, Wiz, Cloudflare, and Okta.

• Dedicated teams for compliance, IT, and infrastructure, allowing a focus on engineering tasks.

• Visa sponsorship is not available.