Application Security Engineer

About the Role

As an Application Security Engineer, you will partner directly across Security and Engineering to build a friction-free, developer-centric security program. You will shape our Secure SDLC, automate security guardrails in our CI/CD pipelines, scale our private bug bounty program, and foster a strong culture of security champions across a globally distributed team.

Key Responsibilities:

• Automate Security Controls: Integrate proactive security tooling (SAST, DAST, SCA) directly into CI/CD pipelines (GitHub/GitLab) to catch vulnerabilities before code hits production.
• Define & Drive Secure SDLC: Design, communicate, and maintain developer-friendly SDLC processes, frameworks, and threat modeling practices (e.g., STRIDE).
• Manage Bug Bounty & Triage: Spearhead our private bug bounty program,tracking spends, triaging reports, and lowering Mean Time to Mitigation (MTTM).
• Build Engineering Capability: Share best practices through secure coding training and cultivate a Security Champions network across Engineering.
• Lead AppSec Reviews: Conduct threat models and code reviews for Java and Python microservices.
• Amplify Security Culture: Partner with external communications to author technical blogs, manage vulnerability disclosures, and showcase VGS’s security engineering.

What You Bring

• AppSec Experience: 3–5+ years of dedicated experience in Application Security and/or full stack development, with proven experience.
• Technical Depth: Practical background conducting secure code assessments for Java and Python applications.
• Tooling & Automation: Deep familiarity integrating SAST/DAST tools (e.g., GitHub Advanced Security, ZAP/BURP, Synopsys/Veracode, Semgrep and similar tools) into modern CI/CD systems.
• Vulnerability & Program Management: Hands-on experience operating bug bounty programs and setting program metrics/KPIs.
• Threat Modeling: Practical experience applying frameworks like STRIDE to complex systems.
• Collaborative Mindset: Exceptional communication skills with a track record of building trust across engineering teams.

Nice to Have:

• BA/BS degree
• A knack for out-of-the-box thinking that thrives in a fast-paced startup environment
• Prior experience in cloud-native, high-growth, or pre-IPO fintech startups.
• Hands-on experience with AWS security controls and cloud infrastructure.
• Comfortable navigating fully remote, globally distributed work environments.