# Application Security Engineer

**Company**: VGS
**Location**: United States
**Work arrangement**: remote
**Experience**: senior
**Job type**: Full Time
**Salary**: USD 175,000-230,000 per-year-salary
**Category**: Engineering
**Industry**: Technology

**Apply**: https://jobs.lever.co/verygoodsecurity/c9dd48c1-c6f9-47b2-b622-c9259b4a1ef6?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_0a14d6e1-eb7

## Description

## About the Role

As an Application Security Engineer, you will partner directly across Security and Engineering to build a friction-free, developer-centric security program. You will shape our Secure SDLC, automate security guardrails in our CI/CD pipelines, scale our private bug bounty program, and foster a strong culture of security champions across a globally distributed team.

### Key Responsibilities:

- Automate Security Controls: Integrate proactive security tooling (SAST, DAST, SCA) directly into CI/CD pipelines (GitHub/GitLab) to catch vulnerabilities before code hits production.

- Define & Drive Secure SDLC: Design, communicate, and maintain developer-friendly SDLC processes, frameworks, and threat modeling practices (e.g., STRIDE).

- Manage Bug Bounty & Triage: Spearhead our private bug bounty program,tracking spends, triaging reports, and lowering Mean Time to Mitigation (MTTM).

- Build Engineering Capability: Share best practices through secure coding training and cultivate a Security Champions network across Engineering.

- Lead AppSec Reviews: Conduct threat models and code reviews for Java and Python microservices.

- Amplify Security Culture: Partner with external communications to author technical blogs, manage vulnerability disclosures, and showcase VGS’s security engineering.

### What You Bring

- AppSec Experience: 3–5+ years of dedicated experience in Application Security and/or full stack development, with proven experience.

- Technical Depth: Practical background conducting secure code assessments for Java and Python applications.

- Tooling & Automation: Deep familiarity integrating SAST/DAST tools (e.g., GitHub Advanced Security, ZAP/BURP, Synopsys/Veracode, Semgrep and similar tools) into modern CI/CD systems.

- Vulnerability & Program Management: Hands-on experience operating bug bounty programs and setting program metrics/KPIs.

- Threat Modeling: Practical experience applying frameworks like STRIDE to complex systems.

- Collaborative Mindset: Exceptional communication skills with a track record of building trust across engineering teams.

### Nice to Have:

- BA/BS degree

- A knack for out-of-the-box thinking that thrives in a fast-paced startup environment

- Prior experience in cloud-native, high-growth, or pre-IPO fintech startups.

- Hands-on experience with AWS security controls and cloud infrastructure.

- Comfortable navigating fully remote, globally distributed work environments.

## Skills

### Required
- Application Security
- Full Stack Development
- Secure SDLC
- Threat Modeling
- Bug Bounty Management
- Security Automation
- Java
- Python
- SAST
- DAST
- SCA
- CI/CD Pipelines

### Nice to have
- BA/BS degree
- Cloud-native experience
- Fintech experience
- AWS security controls
- Remote work experience

---

Source: [Apply at jobs.lever.co](https://jobs.lever.co/verygoodsecurity/c9dd48c1-c6f9-47b2-b622-c9259b4a1ef6?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)