Staff Engineer, Application Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Define and lead the comprehensive security strategy across applications, cloud infrastructure, and AI systems.

• Identify the most significant risks and spearhead cross-functional initiatives to mitigate them.

• Conduct security architecture assessments, threat modeling, code evaluations, and security testing.

• Collaborate with engineering teams to integrate security into the Software Development Life Cycle (SDLC) and eliminate classes of vulnerabilities through secure-by-default practices and guardrails.

• Establish and execute security guardrails for applications powered by large language models (LLMs), AI agents, coding assistants, and integrations with MCP/tools.

• Enhance security across AWS/GCP, containers, CI/CD, IAM, and the software supply chain by implementing scalable controls and automation.

• Advance the processes of vulnerability discovery, prioritization, remediation, and detection.

• Offer technical leadership during major security incidents.

• Collaborate with Engineering, Infrastructure, IT, Legal, and other departments on security architecture, policies, compliance programs, and emerging risks.

• Elevate engineering security capabilities through tools, training, security champions, technical advice, and mentorship.

⛳️ Requirements

• Over 7 years of experience in application, product, cloud, or infrastructure security, with a strong hands-on background in security engineering.

• Excellent software engineering skills with the ability to read, write, and review production-level code.

• Profound knowledge of application and API security, authentication and authorization, cloud security, and contemporary software development and delivery methods.

• Experience in designing scalable security architectures and implementing secure-by-default controls across applications and cloud environments.

• Awareness of AI and agent-related security risks, including prompt injection, insecure tool usage, excessive permissions, sensitive data exposure, and risks linked to MCP and third-party AI integrations.

• Expertise in AWS security services, including IAM, WAF, GuardDuty, and AWS Inspector.

• Familiarity with CodeQL, Burp Suite, Zap, and Nuclei.

• Strong comprehension of networking, security, and fundamental Internet protocols, including TCP/IP, DNS, SMTP, SSL, and distributed networks.

• Capability to lead complex security projects across various teams, influence technical direction, and work independently in ambiguous situations.

• Excellent communication skills with the ability to translate security risks into actionable engineering decisions.

• Experience with AWS security services, application security tools, SOC 2/ISO 27001, and AI-assisted security solutions is advantageous.

• Must be eligible to work in the United States without current or future immigration sponsorship.

🏝️ Benefits

• Target annual bonus of 15% of base salary.

• Participation in long-term incentive programs linked to company growth and performance.

• Fully remote work environment.

• Home office setup allowance.

• No pre-set vacation limits.

• Parental leave benefits.

• Health and wellness benefits.

• 401(k) plan with employer contributions.

• Opportunities for learning and growth.