Senior Application Security Engineer

Upstart

Confirmed live today High trust
Remote

Quick summary

Work type
Remote
Location
Canada
Salary
$166,900–$230,900 / yr
Posted
53 days ago
Freshness
Confirmed live today
Closes
Jan 22, 2027

Market check

Salary context

Competitive pay

How this pay compares to similar roles

Similar $181k
This role $199k
$132k $241k
below market most similar roles pay here above market

This role pays more than 62% of similar roles. Most pay $146,016–$216,300 — the blue band above. At the midpoint, this role pays about $199k versus about $181k for comparable roles.

Based on 240 similar postings.

Employer

About Upstart

Upstart is an AI lending platform that partners with banks and credit unions to expand access to affordable credit using non-traditional variables.

Upstart currently has 54 open roles on FindRole.

Listed pay typically runs $166,900–$230,900 across 53 roles with salary data.

Most-posted roles

View all roles at Upstart

At a glance

TL;DR · Senior Application Security Engineer

The Senior Application Security Engineer joins the Application Security team to enable product and engineering teams to build secure products without slowing innovation. You will lead application security projects, conduct threat modeling, and perform security architecture reviews for complex customer-facing applications, APIs, distributed services, and AI/ML systems. Your daily work involves designing secure-by-default controls, building automation for vulnerability detection, and assessing the security of GenAI integrations and agentic systems. You will utilize Java, Python, Ruby, or Go to develop production software and security automation. Key responsibilities include managing secrets, implementing SAST, DAST, and SCA, and ensuring API security across cloud-native microservices. This role solves critical security challenges within a regulated environment, specifically protecting AI-enabled systems and sensitive data handling while maintaining a positive developer experience.

What you'll do

  • Lead application security projects from planning through implementation to deliver high-quality outcomes.
  • Conduct threat modeling and security architecture reviews for customer-facing applications, APIs, and AI/ML systems.
  • Design and implement secure-by-default controls including secure coding standards, API protections, and CI/CD safeguards.
  • Partner with engineering teams to identify systemic vulnerabilities and drive effective remediation of high-risk issues.
  • Build services and automation to improve vulnerability detection, prioritization, and prevention while reducing developer friction.
  • Assess the security of AI-enabled products, including GenAI integrations, model inputs, and sensitive-data handling.
  • Provide technical leadership during high-severity security incidents to determine root causes and drive durable improvements.
  • Improve team effectiveness by contributing to design reviews, documenting reusable patterns, and mentoring engineers.

What we're looking for

  • Must have 5+ years of experience in security engineering, software engineering, or a related technical role.
  • Must have 2+ years of experience specifically focused on application or product security.
  • Must have experience leading security projects involving multiple contributors or partner teams.
  • Must have experience conducting threat modeling and security architecture reviews for complex production applications.
  • Must have experience developing production software or security automation in Java, Python, Ruby, Go, or a similar language.
  • Must have experience designing or implementing application security controls such as API security, SAST, DAST, SCA, or secrets management.
  • Must have experience securing cloud-native or distributed systems, including web applications, APIs, or microservices.
  • Must be authorized to work in the U.S. or Canada (excluding Quebec).

More like this

Similar roles

Application Security Engineer

Booz Allen Hamilton

Annapolis Junction, MD +1 39 days ago $69,400–$158,000
SAST DAST SCA DevSecOps Secure SDLC Container Security Cloud Security Vulnerability Management OWASP SAMM BSIMM NIST SSDF NIST CSF ISO 27001 MITRE ATT&CK ISO/IEC 42001 IEC 62443
2+ yrs exp

Application Security Engineer

Booz Allen Hamilton

Washington, DC 14 days ago $62,000–$141,000
SAST DAST Threat Modeling Burp Suite Veracode Java Python .NET C# Linux UNIX OWASP NIST 800-53 FIPS FedRAMP IAST Eclipse JDeveloper
6+ yrs exp

Application Security Engineer

State Street

Quincy, MA +4 60 days ago
DevSecOps AppSec CI/CD SAST DAST SCA Python Java .Net Node.js AWS Azure Kubernetes Terraform Ansible Infrastructure as Code Agile API Security Container Security SSDLC
6+ yrs exp

Senior Application Security Engineer

Chime

San Francisco, CA 25 days ago $213,000–$295,000
Mobile Application Security iOS Android Ruby Go Python CI/CD Penetration Testing Dynamic Analysis Threat Modeling Identity and Authentication Secure Data Storage AI Security Code Review
5+ yrs exp Hybrid

Senior Application Security Engineer

Arch Capital Group

Farmington, CT 14 days ago $127,000–$172,000
Application Security SAST DAST SCA CI/CD DevSecOps AWS Azure Containers Serverless Threat Modeling NIST OWASP MITRE SDLC Vulnerability Management
5+ yrs exp Hybrid

Application Security Engineer

Opendoor

Miami 131 days ago
Python Go TypeScript Ruby Terraform AWS GCP Azure Kubernetes Apollo GraphQL GraphQL GitHub Advanced Security CodeQL Semgrep HackerOne Burp Suite Cloudflare WAF Claude OpenAI Threat Modeling REST gRPC Mobile Security
Hybrid