Staff Application Security Engineer

Salary: $168,000 - 240,000 per year Requirements:

• Were looking for someone who can lead design reviews, threat modeling, secure code reviews, and penetration testing with an attackers mindset.
• We need strong command of application security fundamentals and familiarity with common weaknesses such as SSRF, race conditions, and privilege escalation.
• We expect deep code review expertise in Scala, Java, Go, or similar languages, along with hands-on building experience in Python, Go, or comparable languages.
• We want experience creating custom detection and preventive application security controls that address risks beyond the OWASP Top 10.
• We value familiarity with highly regulated environments such as financial services, fintech, or crypto, and the ability to connect business goals with security risk.
• We need strong cross-functional communication and collaboration skills across Security, Engineering, and Product.
• We typically look for 7-10+ years of experience, or equivalent impact, in application security, product security, or a closely related field.
• Preferred: experience building AI application security tooling using agents or skills.
• Preferred: experience with supply chain security, SLSA, OWASP SPVS, and other CI/CD security controls.
• Preferred: experience preventing application security issues at scale through secure design patterns, automation, or frameworks.
• Preferred: experience working with microservice architectures and cloud-native environments.

• We own and continuously improve our Secure Software Development Lifecycle guardrails as application security subject matter experts.
• We lead architecture reviews, threat modeling, code reviews, and penetration testing for high-risk applications and services.
• We design and build AI agents across the SDLC to automate threat modeling, support secure code generation and review, and reduce AppSec toil.
• We create and deliver hands-on application security training so engineers can work securely at scale.
• We participate in the Application Security on-call rotation and drive hardening work after incidents.

• AI
• AI Agents
• CI/CD
• Cloud
• Support
• Java
• OWASP
• Python
• Scala
• Security
• Web3

More:

We are Gemini, a global crypto and Web3 platform founded in 2014, serving individuals and institutions in more than 70 countries with simple, reliable, and secure crypto products and services. Our mission is to unlock the next era of financial, creative, and personal freedom by providing trusted access to the decentralized future. Our Application Security team exists to ensure security is built in from the start, partnering closely with engineering to protect critical surfaces across on-chain, exchange, and credit card products. This Staff Application Security Engineer role offers significant autonomy, direct collaboration with senior engineering leadership, and the opportunity to build AI-driven security capabilities at scale. In the United States, we offer a hybrid work model at our hub offices, with remote options for employees outside hub areas, and all employees onboard in person. We also provide competitive pay, discretionary annual bonus, long-term equity, comprehensive health coverage, 401K matching, paid parental leave, and flexible time off. The New York base salary range for this role is $168,000 to $240,000, excluding bonus and equity.

last updated 33 week of 2026