Описание

Join our team as a Senior Application Security Engineer. You will be a senior technical leader in the application security program, working with R&D teams to build security into how we design, build, and ship our products. You will help build a modern product security program that uses automation, pipeline integration, and AI-assisted workflows rather than manual review alone.

Responsibilities

Review high-risk code and designs, and help engineers fix issues at the root rather than one finding at a time
Build and tune security checks in CI/CD, including static and dynamic analysis, dependency and container scanning, and secrets detection, with a focus on accuracy and low noise
Triage and prioritize vulnerabilities by real risk, work with engineering owners to drive remediation, and track progress against service levels
Improve visibility and control of third-party and open-source dependencies, including SBOM generation and accuracy
Develop automation and AI-assisted workflows for triage, code review, and reporting that remove manual work and scale the team
Work with the offensive security team and perform penetration tests and bug bounty reports, and turn findings into fixes and better standards
Support the PSIRT process by analyzing reported vulnerabilities, assessing impact, and helping engineering ship and communicate fixes
Contribute to secure coding standards, guardrails, and a paved road for engineers, and run training or office hours that make teams more self-sufficient
Mentor Security Engineers, review their work, and lead workstreams and projects across R&D with limited supervision
Design, build, and run a fleet of AI agents that take on AppSec work at scale, such as triaging scanner findings, validating exploitability, reviewing pull requests and designs for security issues, drafting threat models, proposing fixes, and routing vulnerabilities to the right owners
Define the guardrails, human approval points, evaluation methods, and audit trail that keep agent output accurate, safe, and trusted by engineers, and report the impact on risk and review capacity

Requirements

6–9 or more years in cybersecurity, security engineering, or software engineering, including at least 4 years in application or product security
Strong knowledge of common vulnerability classes, secure design, threat modeling, and authentication and authorization in cloud-native, API-driven applications
Strong programming skills in at least one language such as Python, Go, Java, or TypeScript, and the ability to review other engineers’ code for security issues
Hands-on experience with application security tools, including SAST, SCA, DAST, and secrets scanning, and with integrating them into CI/CD pipelines
Working knowledge of at least one major cloud provider and of securing containerized workloads
Track record of working with engineering teams to get security work prioritized and done
Track record of developing other engineers
Clear written and verbal communication with engineers, product teams, and senior leaders

Nice to have

Experience securing LLM-based features and agent systems, including prompt injection and data exposure risks
Experience in penetration testing, vulnerability research, or bug bounty work
Experience with SBOM tooling, dependency management, and build integrity
Familiarity with Terraform, Kubernetes security, and cloud posture tooling
Certifications: OSCP, CSSLP, GIAC, or similar

We offer

Full-time employment

Hiring process

Apply for this job