Application Security Engineer

Role Description

As we scale, so does the trust our customers place in us to protect their data. We're hiring a Senior Application Security Engineer to help harden our platform — from how we isolate workloads and control access, to how we secure our network, harden our applications, achieve audit-grade observability, and lock down our software supply chain.

This is a hands-on, high-ownership role. You'll be a primary builder on a broad security roadmap spanning cloud infrastructure, identity, network, application, observability, and the software supply chain — turning it into shipped, operational reality alongside platform, infrastructure, and product engineering teams. We're looking for someone who can go deep on any one of these areas when needed, while staying comfortable moving across all of them, and who has a sharp read on how AI is reshaping both the threats we defend against and the tools we defend with.

This position is fully remote in Utah.

What You’ll Do

• Help design and execute a multi-year application and platform security roadmap spanning cloud infrastructure, identity, network, application, observability, and the software supply chain.
• Harden our AWS and Kubernetes environments — from account/organization structure and IAM to workload identity, network segmentation, and zero-trust access.
• Strengthen authentication and application-layer defenses, including anti-abuse protections, secure headers, and multi-tenant isolation.
• Build out the security observability stack: audit logging, cloud posture monitoring, runtime threat detection, and deception-based detection techniques.
• Embed security into the SDLC — CI/CD gates, secret scanning, threat modeling, and software supply chain integrity (SBOMs, artifact signing, provenance), accounting for the new risks and review needs introduced by AI-generated code and AI-assisted development workflows.
• Evaluate and adopt AI-powered security tooling — from AI-assisted pentesting and code review to anomaly detection — to help our small team punch above its weight.
• Work closely with the security lead to prioritize this work, balancing finite hardening projects against the ongoing operational load of running a security program that scales with the company.
• Serve as a trusted security resource for engineering teams — reviewing designs, unblocking teams on secure implementation patterns, and helping raise security literacy across the org.
• Support customer and compliance conversations where deep technical credibility is needed.

Qualifications

• 8+ years of professional experience in application security, security engineering, or a closely related discipline, with a track record of driving substantial security initiatives from design through to production.
• Deep, hands-on expertise across most of the following: cloud account/organization security (AWS preferred), IAM and least-privilege design, Kubernetes and container security, network security and zero-trust access (e.g., Tailscale, mTLS), web application security (WAF, CSP, authentication/anti-abuse), security observability (SIEM/audit logging, CSPM, runtime detection), and secure SDLC/supply chain security (SAST/DAST, secret scanning, SBOM, artifact signing).
• A working understanding of how AI is currently shaping the security landscape — both offensively (AI-assisted phishing, automated exploitation, LLM-specific attack surfaces) and defensively (AI-assisted detection, code review, and pentesting) — and the judgment to separate real risk and real value from hype.
• Demonstrated ability to go deep on a single domain when the problem demands it, and to reason credibly across all of them when setting priorities.
• Experience threat modeling new features and influencing engineering design decisions before code is written.
• Strong communication skills — able to translate security risk into terms that engineers, product managers, and leadership can act on.
• Comfort operating with significant autonomy in a fast-moving environment, and pulling in the right partners across the org to get things done.

Bonus Points

• Experience securing multi-tenant SaaS platforms, including tenant-isolation testing or red-teaming.
• Relevant certifications (e.g., OSCP, GWAPT, GCSA, or similar) — nice to have, not required.
• Experience building or operating detection engineering programs (honeytokens, canary credentials, runtime threat detection).
• Prior experience in a regulated or compliance-heavy environment (SOC 2, ISO 27001, etc.).
• Hands-on experience securing AI/LLM-powered features or evaluating the security posture of AI coding tools and agentic workflows.

Benefits

• Flexible Paid Time Off - you’re actually encouraged to use, plus 10 company holidays!
• ❤️‍ Health Benefits - including Medical, Dental, and Vision and an HSA Match.
• 401(k) - we match 100% up to 3% of your contribution. Eligibility is immediate with 100% vesting.
• Mental Health - all employees have access to Impact Suite & to our Employee Assistance Program (EAP).
• Paid New Parent Leave & Birthing Parent Leave - so you’re able to care for your little ones.
• ➕ Supplemental Benefits - including 100% company paid Basic Life & AD&D insurance and long & short-term disability coverage.
• Nectar - our peer-to-peer recognition program to help our employees recognize the amazing work being done by other Canopians!
• Company Events - including monthly company-wide meetings, summer parties, and more.
• ERG Committees - to plan initiatives around continuing education, community outreach, recruiting, onboarding, and more.
• ☕ Fully-stocked kitchen - Keto? Vegan? Flexitarian? Mandalorian? We’ve got you covered.