Senior Application Security Engineer

We are hiring a Senior Application Security Engineer to build how our enterprise secures software, from first commit to production. You will design the guardrails, automation, and AI-powered tooling that let engineering teams ship securely by default, and you will prove they work with data.

Responsibilities:

Secure SDLC & DevSecOps

• Build security into the SDLC as paved roads, so the secure path is the easiest path for every engineering team.
• Define the secure coding standards and reference patterns that teams across the enterprise build against.
• Build the vulnerability prioritization capability that shows where real risk sits across code, pipelines, and deployed services, and drive remediation to measurable closure.
• Establish a threat modeling practice for applications, APIs, and delivery pipelines that scale beyond a single team.

CI/CD & software supply chain security

• Architect the security control layer for our CI/CD platforms (GitHub Actions, Jenkins, GitLab, Azure DevOps) so every pipeline inherits it by default.
• Design the automated testing pipeline that runs SAST, DAST, SCA, and container scanning on every build, tuned for signal over noise.
• Build the automation that keeps our attack surface visible: API discovery, dependency scanning, SBOM generation, and secrets detection.

AI/LLM security & AI-powered automation

• Build reusable AI agent skills and workflows inside CI/CD (e.g., agentic coding tools, MCP-based integrations) that review every pull request for insecure patterns, authN/authZ gaps, secrets exposure, and risky dependency changes, and deliver CWE/OWASP-mapped findings developers can act on.
• Build AI-driven security testing that generates targeted test cases (API abuse cases, fuzzing inputs, prompt-injection and jailbreak suites), triages SAST/SCA/DAST results to cut false positives and proposes remediation PRs for human review.
• Define the guardrails AI agents operate under our pipelines: least-privilege tokens, human-in-the-loop approval, output-accuracy evaluation, and audit logging.
• Build the AI-specific scanning capability that catches insecure LLM orchestration patterns before they ship.
• Establish a reusable threat modeling approach for RAG architectures and autonomous agents.
• Define the framework for secure AI adoption in enterprise applications, covering data security, access controls, model input/output handling, and misuse prevention.

Partnership & enablement

• Demonstrated ability to drive initiatives end-to-end, taking ownership of tasks, deliverables, and outcomes.
• Shape product, platform, and DevOps roadmaps as trusted advisors, translating technical risk into business decisions.
• Choose, implement, and prove the tooling that closes the gaps we have today, with metrics that show the impact.
• Grow security capability inside engineering teams through mentoring secure coding and pipeline practices.
• Help scale the Security Champions program into a self-sustaining network.

Requirements:

• 6+ years in Application Security, Product Security, or Secure Software Development, with a track record of building capabilities, not only operating them.
• Has designed security controls for CI/CD pipelines and source repositories (GitHub, GitLab, Jenkins, or similar) at scale.
• Has built and tuned SAST, DAST, SCA, and container scanning, so developers trust and act on the results.
• Has built and tuned WAF and API protections and driven vulnerability remediation to closure.
• Applies SLSA and NIST SSDF to design build integrity, including secrets management and artifact signing.
• Has designed security controls in AWS, Azure, or GCP.
• Deep understanding of OWASP Top 10 (Web & API), CWE, and secure coding practices.
• Working knowledge of OWASP Top 10 for LLM Applications and MITRE ATLAS.

Benefits:

• Comprehensive suite of benefits that supports physical, financial, and emotional wellbeing.
• Investment in career development and growth.
• Unconditional inclusion and celebration of individual uniqueness.