Application Security Engineer

Who you are

• Experience: 5+ years of experience in software engineering or security engineering, specifically focusing on product security or application security
• Technical Skills:
• Proficiency in one or more programming languages (e.g., Python, Go, Java, or JavaScript)
• Deep understanding of modern web/cloud architecture (e.g., APIs, Microservices, Kubernetes, AWS/GCP/Azure)
• Familiarity with the OWASP Top 10 and common exploitation techniques
• Collaboration: Proven ability to influence and collaborate with engineering teams without hindering development velocity
• Problem Solving: Strong analytical skills to evaluate complex systems and design innovative, practical security solutions
• Experience with Infrastructure as Code (IaC) security (e.g., Terraform, CloudFormation)
• Experience in designing cryptographic implementations or secure authentication/authorization flows (e.g., OAuth, OIDC, JWT)
• Knowledge of compliance frameworks relevant to our industry (e.g., SOC2, ISO27001, HIPAA)

What the job involves

• We are looking for a Product Security Engineer to join our team and act as a champion for security within our product engineering organization. You will be responsible for ensuring our products are designed, developed, and maintained with security as a core pillar.
• You will work in partnership with development squads to perform threat modeling, guide secure architecture decisions, and automate security gates in our CI/CD pipelines
• Security by Design: Lead threat modeling sessions during the architectural design phase of new features to identify potential risk vectors early
• Secure Development Lifecycle (SDLC): Drive the adoption of "Shift Left" security practices, integrating security tooling (SAST, DAST, SCA) directly into developer workflows
• Vulnerability Management: Triage, prioritize, and partner with engineering teams to remediate vulnerabilities found in code, third-party libraries, and cloud infrastructure
• Security Tooling & Automation: Build, maintain, and tune security automation tools to reduce friction for developers while maintaining high-security standards
• Secure Coding Standards: Develop and deliver training, coding patterns, and security guardrails to help engineering teams build resilient, secure-by-default products
• Incident Response Support: Assist in identifying the root cause of security incidents related to product features and contribute to post-incident remediation and architectural improvements
• Supply Chain Security: Build out processes and automation to ensure the security of open-source dependencies