Staff Application Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop, uphold, and enhance secure SDLC policies, standards, control objectives, procedures, and evidence requirements on a company-wide basis.

• Convert security policies into actionable requirements for development, product, and platform teams.

• Evaluate development teams, CI/CD pipelines, source-control practices, build environments, and release processes; establish improvement roadmaps.

• Create secure-development guidance, reference architectures, reusable patterns, security guardrails, exception processes, and materials to empower developers.

• Collaborate with development teams to identify, triage, prioritize, remediate, and validate application-security findings.

• Assess, implement, optimize, and operationalize SAST, DAST, SCA, secrets detection, infrastructure-as-code scanning, container and image scanning, API, and cloud-native security mechanisms.

• Lead or facilitate threat modeling, defining security requirements, and conducting secure design or architecture reviews.

• Establish risk-based vulnerability management processes, remediation goals, compensating controls, risk acceptance, escalation, and exception management protocols.

• Oversee vulnerable third-party, open-source, and transitive dependencies.

• Implement open-source software governance, encompassing component inventory, license identification, reviews, approvals, and enforcement.

• Enhance software supply-chain security through SBOMs, VEX or equivalent communications, build and release provenance, artifact signing and verification, trusted promotion, secure repositories, package integrity, and SLSA-aligned controls.

• Collaborate with DevOps and platform engineering to secure CI/CD pipelines, source-code repositories, build systems, dependency registries, artifact repositories, and deployment pipelines.

• Assist with vulnerability intake, coordinated disclosure, customer-facing security advisories, CVE triage, and product-security incident response.

• Establish and lead a security champions program offering secure-coding guidance, training, office hours, tools, and pathways for security engagement.

• Generate executive-level metrics and reports on secure-SDLC adoption, AppSec risk, remediation, control coverage, supply-chain integrity, and program maturity.

• Assist in customer, regulatory, audit, and assurance activities.

• Function as a Staff-level individual contributor influencing engineering, security, product, and technology leadership.

⛳️ Requirements

• Over 7 years of experience in application security, product security, DevSecOps, secure software engineering, cybersecurity engineering, or a related discipline.

• Proven experience in designing, implementing, or advancing a secure SDLC or application-security program across multiple engineering teams.

• Solid understanding of secure coding practices, application-security testing, vulnerability management, software delivery, and DevSecOps principles.

• Experience directly engaging with developers to clarify findings, guide remediation efforts, and enhance secure-development practices.

• Practical experience with SAST, DAST, SCA, dependency vulnerability management, secrets scanning, and related application-security tools.

• Familiarity with integrating security controls into source-control, CI/CD, build, release, and deployment workflows.

• Experience in performing or facilitating threat modeling, security design reviews, architecture reviews, or defining security requirements.

• Knowledge of authentication, authorization, API security, insecure deserialization, injection vulnerabilities, insecure dependency usage, secrets exposure, and business-logic vulnerabilities.

• Experience with SBOMs, dependency provenance, build integrity, artifact signing, release attestations, and secure artifact management.

• Experience in managing open-source software risks, vulnerable dependencies, transitive dependencies, license obligations, and governance processes.

• Familiarity with NIST SP 800-218 / SSDF, OWASP SAMM, SLSA, or similar frameworks.

• Capability to read and evaluate production code and scripts in one or more modern programming languages.

• Excellent written and verbal communication skills.

• Preferred: experience with SLSA, VEX, CSAF, SPDX, CycloneDX, cloud-native applications, containers, Kubernetes, APIs, microservices, infrastructure-as-code, source-control, CI/CD, cloud, artifact management, package management, container registry platforms, listed AppSec tools, regulated environment requirements, high-assurance environments, and relevant certifications.

• All offers are contingent on a cleared background and potential reference verification.

• U.S. work authorization and export-control eligibility questions are part of the application process.

🏝️ Benefits

• Bonus

• Benefits

• Equity

• Temporary benefits package applicable after 60 days of employment for temporary employees.

• Potential support for customer, regulatory, audit, and assurance activities.