Security Engineer, Application Security

Responsibilities

• Embed security review workflows and PR-level analysis into the software development lifecycle.
• Build and tune SAST/DAST pipelines integrated into CI/CD.
• Create vulnerability management processes based on exploitability and drive findings through verified remediation.
• Develop secure coding standards and guardrails for more than 50 engineers.
• Create threat models for new features and architecture changes, including AI data pipelines, payment flows, and multi-tenant boundaries.
• Operate the bug bounty program by triaging HackerOne reports, validating findings, and driving fixes to closure.
• Use AI tools to accelerate code review, threat modeling, vulnerability analysis, and security automation.

Requirements

• Find and fix real vulnerabilities in production applications rather than only running scanners.
• Have deep web application security knowledge, including OWASP Top 10, attack chains, and business logic flaws.
• Be strong in at least one of Python, TypeScript, or Go.
• Have experience building or tuning SAST/DAST tooling such as Semgrep, CodeQL, Snyk, or Burp.
• Understand modern web frameworks, APIs, and authentication patterns well enough to threat model them.
• Have experience managing vulnerability pipelines from discovery through prioritization and verified remediation.
• Have at least 5 years of professional experience in application security, security engineering, or software engineering with a strong security focus.
• Bonus qualifications include bug bounty operations with HackerOne or Bugcrowd, penetration testing, AI/ML application security, supply chain security, custom security tooling, open source security contributions, or published vulnerability research.

Benefits

• Bi-annual performance bonus structure.
• Generous equity grant vested over four years.
• Up to $15,000 relocation bonus.
• $10,000 housing bonus for employees living within 0.5 miles of the office.
• $1,500 monthly meal stipend.
• Free Equinox membership.
• $200 monthly laundry reimbursement.
• $200 monthly personal wellness reimbursement.
• Health, dental, and vision insurance.
• In-person work five days per week in San Francisco, New York City, or London, with first Fridays remote.