Application Security Engineer

Responsibilities

• Perform security assessments, threat modeling, architecture reviews, and secure code reviews for enterprise applications, APIs, and cloud services.
• Evaluate authentication, authorization, data protection, secrets management, and other application controls, and partner with developers on remediation.
• Develop secure design patterns and provide secure coding guidance throughout the software development lifecycle.
• Assess AI-enabled applications involving LLMs, RAG, agents, connected tools, and MCP integrations for security risks.
• Define AI security review criteria, technical guardrails, identity and access controls, logging, and detection and response practices.
• Build security testing into developer workflows, including static and dynamic testing, dependency analysis, secrets detection, and API testing.
• Develop scripts, tools, and integrations for vulnerability analysis, remediation tracking, and repeatable security processes.
• Maintain and troubleshoot security solutions while aligning work with compliance requirements and internal controls.

Requirements

• At least five years of related experience in application security, security engineering, software engineering, or a related technical security discipline.
• Experience with application assessments, threat modeling, architecture reviews, secure code reviews, common application vulnerabilities, and security defenses.
• Understanding of web applications, APIs, cloud services, authentication, authorization, secrets management, and data protection, with the ability to read application code.
• Experience with security testing tools, automated security checks, AWS, API penetration testing, microservices, and Kubernetes in multi-team enterprise environments.
• Foundational understanding of generative AI, LLM-enabled applications, and related security risks, or the ability to develop that knowledge quickly.
• Familiarity with AI risk and governance frameworks and AI threats such as prompt injection, data leakage, model or supply chain compromise, and misuse of autonomous agents is preferred.
• Practical AI security experience and experience with Python or another scripting language are preferred.
• Strong communication skills for translating technical risks into clear recommendations for technical and non-technical audiences.
• Undergraduate degree in Computer Science, Cybersecurity, Software Engineering, or a related field, or an equivalent combination of education and experience.
• Applicants must be legally eligible to work in the United States.

Benefits

• Comprehensive medical, dental, and vision benefits.
• 401(k) and paid time off.
• Potential semi-annual discretionary performance bonus.
• Hybrid work arrangement in Redmond, Washington with regular onsite work; fully remote work is not available.