Security Engineer, Application Security

Responsibilities

• Embed application security into every phase of the SDLC through security-by-design engagements, threat modeling, secure code reviews, and secure coding guidance.
• Establish secure API patterns and architectural standards for REST and GraphQL systems.
• Integrate and maintain security tooling and security quality gates across CI/CD pipelines, including hardening GitHub Actions and runner environments.
• Partner with DevOps engineers to secure AWS infrastructure, Kubernetes workloads, infrastructure-as-code, container deployments, WAFs, and CDN security.
• Operate the application vulnerability management lifecycle, triage findings, identify systemic risks, and coordinate remediation initiatives.
• Track security KPIs and communicate actionable security risk insights to engineering and business leadership.
• Coach engineers through documentation, workshops, lunch-and-learns, and actionable remediation guidance.
• Participate in the weekly on-call rotation.

Requirements

• At least 3 years of application security engineering experience.
• Experience building and operating internal security developer platforms or tooling that reduces developer friction.
• Experience using AI/ML-driven tools to improve security effectiveness and scalability.
• Hands-on experience leading threat modeling engagements and designing secure paved roads.
• Proven experience integrating security tooling into CI/CD pipelines.
• Working knowledge of the OWASP Top 10 for web, mobile, API, and LLM security.
• Hands-on experience securing AWS deployments with container and Kubernetes security, infrastructure-as-code scanning, and policy-as-code approaches.
• Expertise in security-by-design using TypeScript, Swift, and/or Kotlin.
• Experience implementing secure primitives in iOS and Android ecosystems.
• Beneficial certifications include AWS Certified Security Specialty, CKS, GWEB, GMOB, or equivalent.

Benefits

• Remote work throughout the US, except AK, DE, HI, IA, LA, MS, MT, OK, and SC, or work from the Manhattan, NY office.
• Unlimited vacation policy and paid volunteer opportunities.
• $4,000 technology stipend every two years after starting and a $500 annual work-from-home stipend.
• Monthly physical, mental, wellness, learning, and lifestyle stipends.
• Medical, dental, vision, prescription, FSA, HRA, HSA, and family/dependent health coverage.
• Traditional and Roth 401(k) plans through Vanguard with an immediate company match.
• Basic, supplemental, and dependent life insurance plus short- and long-term disability coverage.
• Company-paid parental leave of up to 20 weeks for birthing parents and up to 12 weeks for non-birthing parents.
• Family-building benefits through Progyny and a DICK'S Sporting Goods family-of-brands teammate discount.
• Weekly on-call rotation is part of the role.