Senior Application Security Engineer

Role Description

The Senior Application Security Engineer is a hands-on technical leader responsible for securing Lumin Digital’s B2B2C SaaS platform across the full software development lifecycle. This role exists at the intersection of application security and AI-augmented engineering:

• Actively uses AI-powered tools such as Claude Code and Claude Security to find vulnerabilities faster, automate remediation, and scale security coverage.
• Leads the effort to secure AI-integrated applications, harden CI/CD pipelines, and establish governance for responsible AI adoption.
• Requires deep technical fluency, a bias toward building and doing over advising, and the ability to operate independently in a fast-moving, remote-first environment.

Qualifications

• Bachelor’s in Computer Science, Cybersecurity, Information Assurance, Software Engineering, or a related field, or an equivalent combination of education and experience.
• Preferred certifications: CSSLP, OSCP, GWEB, or GWAPT.
• Seven (7+) years of progressive experience in application security, software security engineering, or a closely related domain within production SaaS environments.
• Extensive hands-on experience in secure software development, DevSecOps pipeline design, and security testing methodologies (SAST, DAST, SCA, penetration testing).
• Demonstrated experience securing large-scale cloud-native applications, APIs, and microservices architectures.
• Experience leading application security initiatives, defining program strategy, and mentoring engineering teams on secure development practices.
• Demonstrated, regular hands-on use of AI-powered security and development tools as part of daily security engineering workflows.
• Experience assessing AI-specific attack surfaces in LLM-integrated applications.

Requirements

• Deep expertise in AWS security, Kubernetes security, and cloud-native application security best practices.
• Strong programming proficiency with the ability to review and assess security risks in one or more of: Java, C#, JavaScript/TypeScript, Python, Swift, or Kotlin.
• Expertise in secure authentication and authorization mechanisms, including OAuth 2.0, OIDC, SAML, JWT, WebAuthn, and Zero Trust principles.
• Hands-on proficiency with AI-augmented security workflows.
• Strong understanding of OWASP Top 10, OWASP Top 10 for LLM Applications, SANS 25, CVSS/EPSS scoring, and MITRE ATT&CK framework.
• Ability to identify, assess, and mitigate prompt injection vulnerabilities in LLM-integrated applications.
• Experience with secure context window management in AI-powered products.
• Hands-on experience with security automation and scripting (Python, Bash, or equivalent).
• Proficiency in penetration testing methodologies.
• Strong knowledge of encryption standards, cryptographic best practices, and secrets management.
• Ability to communicate complex security concepts to both technical and non-technical audiences.
• Demonstrated ability to work independently in a remote setting while maintaining high performance and accountability.

Benefits

• Medical, dental, and vision insurance.
• 401(k) with company match.
• Flexible PTO plus 12 paid holidays.
• Paid sick leave.
• Paid parental and family leave.
• Lifestyle spending account.
• Tuition reimbursement.
• Cell phone stipend.