Senior Application Security Engineer

Responsibilities

• Own and continuously improve Apollo’s secure software development lifecycle across applications and AI-powered features.
• Perform application security reviews, threat modeling, deep code analysis, penetration testing, exploit development, and remediation validation.
• Manage vulnerabilities from internal reviews, bug bounty programs, penetration tests, SCA/runtime findings, and automated security tooling through closure and verification.
• Configure AppSec tooling and build automations that improve coverage, signal quality, and operational efficiency.
• Embed AI-specific security checks and controls into SSDLC reviews, code analysis, and AI-powered systems.
• Enable engineers and security champions through secure coding guidance, training, documentation, metrics, and actionable remediation patterns.
• Partner with Engineering, Product, Platform, Data, Legal, IT, and security teams to align AppSec priorities with business risk.

Requirements

• At least 5 years of software engineering or application security experience with meaningful hands-on AppSec depth in modern SaaS environments.
• Strong software development skills, including the ability to read, write, and ship production code; Ruby experience is highly valuable and Python or similar scripting ability is a plus.
• Strong Linux and cloud fundamentals, ideally in GCP-backed environments.
• Deep familiarity with application security issues, secure authentication and authorization, secure design, vulnerability management, and developer security tooling.
• Experience with deep code review, penetration testing, exploit-oriented validation, direct vulnerability remediation, and bypass or variant analysis.
• Experience managing findings from bug bounty programs, penetration tests, internal reviews, or automated security tooling through closure and verification.
• Experience using AI-assisted tools, automations, APIs, or structured workflows to improve engineering or security processes at scale.
• Experience securing AI-powered systems or features, including AI API exposure, prompt and response handling, data protection, misuse scenarios, and monitoring.
• Strong written and verbal communication, stakeholder management, and influencing skills.
• Preferred qualifications include AI-native product security reviews, secure-by-design and AppSec observability improvements, developer enablement or security champions experience, and relevant security certifications.

Benefits

• Equity may be included.
• Company bonus or sales commissions/bonuses may be included.
• 401(k) plan.
• At least 10 paid holidays per year, flex PTO, and parental leave.
• Employee assistance program and wellbeing benefits.
• Global travel coverage and life, AD&D, STD, and LTD insurance.
• FSA/HSA and medical, dental, and vision benefits.