Description
iCapital is seeking an experienced Application Security Engineer to join its Information Security team. The successful candidate will work closely with the Head of AppSec and senior team members to build a modern AppSec program, focusing on secure design, API security, and developer enablement.
Responsibilities:
- Support threat modeling and design reviews across a broad and growing service portfolio.
- Contribute to shift-left security initiatives, security in CI/CD, developer guidance, and SAST and SCA remediation workflows.
- Assess API exposure, validate authentication and authorization patterns, and contribute to API security across the organization.
- Develop Python automation to scale AppSec capacity, including triage tooling, finding pipelines, and security context enrichment.
- Collaborate with developers to remediate SAST and SCA findings, reduce false positive noise, and promote security habits across engineering.
Qualifications:
- Practical experience in secure design, threat modeling, API security, offensive security, or SAST/SCA program work.
- Understanding of attack patterns and exploitation techniques.
- Familiarity with OWASP Top 10.
- Experience with API security, particularly with REST and GraphQL assessment.
- Proficiency in building and maintaining security automation using Python.
- Knowledge of web application and API security.
- Ability to work autonomously in an evolving environment.
- Relevant certifications, experience in cloud-native environments, and exposure to AI/LLM security are advantageous.
- Experience as a developer or engineer and fluency in languages such as Ruby, Python, and Scala are desirable.
Benefits:
- Base salary range: $100,000 to $130,000.
- Comprehensive compensation package including salary, equity, and annual performance bonus.
- Employer-matched retirement plan.
- Generously subsidized healthcare with 100% employer-paid dental, vision, telemedicine, and virtual mental health counseling.
- Parental leave and unlimited paid time off (PTO).
- Flexible work arrangement: Monday to Thursday in the office, with remote work on Fridays.