Senior Application Security Engineer

Job Description

Senior Application Security Engineer

\n

Remote across the US and Canada | Full-time | Salary range: $150,000 to $230,000.

\n

\n

There are plenty of security roles where you identify a problem, write a report and hand it to engineering.

\n

\n

I’m working with a remote-first software company looking for a Senior Application Security Engineer who can work directly in the codebase and actually ship the fix.

\n

\n

You’ll contribute across a Node.js and React application, alongside Python, Terraform, AWS and Cloudflare infrastructure.

\n

\n

They need a strong application security engineer who is also a credible software engineer. Someone developers will want involved before something reaches production, not just when a scanner starts shouting afterwards.

\n

\n

What you’ll be doing

\n

\n
• Writing production code to fix vulnerabilities and harden the application and infrastructure
\n
• Building security tooling and automation into CI/CD, making the secure route the easiest route
\n
• Reviewing RFCs and technical designs before problems become considerably more annoying
\n
• Defining secure patterns for authentication, authorization and API security
\n
• Leading threat modelling and turning the results into practical controls
\n
• Improving SAST, DAST, software composition analysis and secrets detection, with an emphasis on useful signals rather than burying engineers in alerts
\n
• Testing web applications and reviewing Node.js and React code using OWASP methodology
\n
• Running the bug bounty programme, from validating reports through to shipping fixes
\n
• Securing AI-powered product features against prompt injection, data leakage and overly broad access to tools, tokens or data
\n
• Using AI coding tools and agentic workflows in your own work, sensibly and with your eyes open
\n

\n

\n

What they need to see

\n

This role needs genuine software engineering ability. It is not enough to know what developers should change. You need to be comfortable opening the codebase and changing it yourself.

\n

\n

\n
• You should bring:
\n
• Strong application and web security experience
\n
• Production software engineering experience, ideally with Node.js and React
\n
• The ability to read, review and write code that other engineers respect
\n
• Experience integrating and maintaining SAST and DAST tooling within CI/CD
\n
• Hands-on AWS security experience
\n
• Infrastructure-as-code experience, ideally Terraform
\n
• A practical understanding of common application and network vulnerabilities, including how to remediate them
\n
• Applied knowledge of cryptography, PKI and TLS
\n
• Experience using AI development tools, plus a realistic understanding of the security problems they can introduce
\n
• Python and Cloudflare experience would be useful.
\n
• Experience securing AI or experience securing AI or LLM-powered features, running a bug bounty programme or contributing to SOC 2 controls would also be helpful.
\n

\n

\n

Why consider it?

\n

The company builds software used by people working across science and research. It is remote-first, well-backed and has teams across Canada and the US.

\n

The interesting bit is the remit. You won’t be joining to police engineering from the sidelines. You’ll help decide how security is built into the product, the infrastructure and the way engineers work, then write the code to make it happen.

\n