Staff Application Security Engineer

Responsibilities

• Lead Apollo’s multi-year application security strategy and convert it into multi-quarter, cross-team initiatives.
• Shape Engineering, Product, Platform, and Data roadmaps so security is incorporated early.
• Set secure design, code review, risk modeling, and AI-generated code standards across teams.
• Lead security architecture reviews and threat modeling for ambiguous, high-scale, multi-team systems.
• Design and drive adoption of shared authorization, secure OAuth and token handling, and SSRF-safe clients.
• Guide vulnerability management across internal reviews, bug bounty programs, penetration tests, SCA, and runtime findings.
• Perform hands-on code review, exploit development, bypass testing, variant analysis, and staged remediation.
• Build and standardize AI-augmented AppSec workflows for code review, threat modeling, triage, and remediation.
• Define security controls for AI systems and agent features, including input/output handling, API exposure, guardrails, tool permissions, and data-exfiltration risks.
• Mentor senior engineers and security champions and scale the security champions program.

Requirements

• Typically 10+ years of software engineering or application security experience with a track record of leading AppSec strategy across several engineering teams.
• Expertise in code review, penetration testing, exploit development, vulnerability analysis, and bypass-resistant remediation.
• Strong software development skills with the ability to ship production code.
• Ruby and Ruby on Rails experience is highly valuable; Python is a plus.
• Strong Linux and cloud fundamentals, ideally including GCP and Kubernetes.
• Deep experience with secure architecture, authentication and authorization patterns, and reusable security building blocks.
• Hands-on experience securing AI-powered systems or agent features.
• Ability to make difficult risk decisions under ambiguity and influence technical and non-technical leaders without formal authority.
• Preferred qualifications include leading security for AI-native products, scaling security champions or developer enablement programs, public security work such as CVEs or research, and OSCP or OSWE certifications.

Benefits

• Equity, company bonus eligibility, a 401(k) plan, at least 10 paid holidays, flexible PTO, parental leave, employee assistance and wellbeing benefits, global travel coverage, life/AD&D/STD/LTD insurance, and FSA/HSA plus medical, dental, and vision benefits.
• The posting provides a U.S. pay transparency range of $225,400–$281,800 in total cash compensation, inclusive of annual base salary and annual bonus as applicable.