Senior Engineer, Application Security

What you'll do

• Embed security into the software development life cycle and product engineering processes.
• Conduct secure design reviews and threat modeling for various product and platform teams.
• Engineer automated security testing at scale, including SAST, DAST, SCA, and secret scanning in CI/CD pipelines.
• Architect and implement secure-by-design patterns, paved roads, and release risk gates.
• Build automation and guardrails using pipeline integrations and policy-as-code to scale coverage.
• Manage security for cloud-native applications, including container, API, and mobile security.
• Maintain secure-coding standards, SBOM/OSS-risk processes, and vulnerability disclosure workflows.

What we're looking for

• 9+ years of experience in application/product security or security-focused software engineering.
• Experience embedding security into the SDLC, including secure design review, threat modeling, and code review.
• Hands-on experience with application security testing tools such as SAST, DAST, SCA, IaC, and secret scanning.
• Experience integrating security tooling like Snyk, Veracode, Checkmarx, Semgrep, or GitHub Advanced Security into CI/CD pipelines.
• Ability to work independently with product engineering teams to remediate vulnerabilities and implement secure-by-design patterns.
• A Bachelor's degree in Cybersecurity, Computer Science, Software Engineering, or a related field is preferred.
• Preferred experience with cloud-native/Kubernetes security, API security, or software supply chain/SBOM.
• Optional certifications include CSSLP, GWAPT, GWEB, OSWE, OSCP, or other cloud security certifications.