Staff Application Security Engineer

About the Role / About the Job
Join a high-growth technology environment as a Staff Application Security Engineer, where helping establish and scale a dedicated application security function is a core focus. In this role, you will leverage deep security expertise along with hands-on software engineering to identify vulnerabilities, enhance development workflows, and create practical security tooling. Your responsibilities will involve designing secure software development practices, leading threat modeling and security reviews, and driving vulnerability remediation across complex APIs, SDKs, and cloud-based systems. This position provides substantial technical autonomy, opportunities to influence engineering practices across the organization, and the ability to address challenging security problems at scale. You will play a pivotal role in integrating security as a fundamental element of product development rather than merely a compliance requirement.

Accountabilities:
As a Staff Application Security Engineer, you will translate security strategy into effective engineering practices, tools, and measurable improvements. Your key responsibilities will entail:

• Designing and implementing a secure software development lifecycle (SDLC), integrating security requirements, design-time threat modeling, secure code reviews, and pre-release testing into engineering workflows.
• Owning and improving application security tooling, including static and dynamic application security testing (SAST/DAST), software composition analysis (SCA), dependency scanning, secrets detection, and container and infrastructure-as-code scanning.
• Integrating security tools into CI/CD pipelines, reducing false positives, establishing clear vulnerability ownership, and ensuring findings prompt meaningful action.
• Developing AI-first security engineering approaches using AI-assisted vulnerability triage, automated remediation, and AI-augmented testing, overseen by evidence-based controls.
• Building reusable security patterns, hardened libraries, and secure defaults for various security aspects such as authentication, authorization, and input validation.
• Contributing directly to production codebases by implementing security fixes, developing security libraries, and building automation and CI integrations.
• Leading threat modeling and architecture security reviews for new products, features, and significant technical changes across various systems.
• Managing vulnerability identification, risk assessment, prioritization, and remediation across different sources of security findings.
• Conducting hands-on security testing, including manual code review and exploitation testing for various vulnerabilities.
• Investigating application-layer security incidents, coordinating with relevant teams for containment, root-cause analysis, and remediation.
• Defining application security logging and alerting requirements and partnering with teams to implement effective detection capabilities.
• Supporting engineering teams through consultations, secure coding guidance, and mentorship programs.
• Developing practical secure coding training based on real application vulnerabilities and lessons learned.
• Mentoring engineers and shaping technical priorities alongside application security leadership.
• Providing technical evidence for security controls and supporting enterprise customer due diligence and assessments.

Requirements:
The ideal candidate will be a skilled security engineer with extensive application security experience and strong software development skills. Required qualifications include:

• A minimum of 8 years in software engineering and/or security engineering, including at least 5 years focused on application security.
• Experience in building or improving application security programs within a product engineering context.
• Proficient in software engineering fundamentals and capable of writing production-quality code in languages like TypeScript, JavaScript, Go, or Python.
• Familiarity with modern web applications, APIs, software architectures, and CI/CD pipelines.
• Extensive knowledge of application security concepts, including OWASP Top 10 vulnerabilities and related security challenges.
• Able to identify vulnerabilities through manual testing and communicate their implications to engineering teams.
• Experience in leading threat modeling and security reviews, producing models that impact engineering decisions.
• Experience deploying and configuring security tools within CI/CD workflows.
• Practical experience with AI-assisted security tools for vulnerability management.
• Ownership experience in managing vulnerability processes, including remediation tracking and SLAs.
• Strong communication skills, capable of conveying technical findings to various stakeholders.
• Excellent analytical skills and a demonstrated ability to work independently on complex initiatives.

Nice-to-have Qualifications:

• Familiarity with fraud detection, bot mitigation, identity security, or device intelligence.
• Strong knowledge of cloud security, particularly AWS IAM.
• Experience securing client-side applications and mobile SDKs.
• Background in operating a bug bounty program.
• Awareness of AI and machine learning security risks.
• Relevant security certifications or contributions to the security community.

Benefits:

• Annual base salary ranging from $177,000 to $240,000, depending on location, experience, and expertise.
• Salary examples: $209,000–$240,000 for New York City and $177,000–$204,000 for Chicago.
• Fully remote work environment, subject to geographic and regulatory considerations.
• Significant technical autonomy and executive-level support for application security initiatives.
• Opportunity to focus on hands-on engineering and vulnerability remediation over administrative tasks.
• Access to leading security technologies.
• Collaboration within a community that treats security as a shared responsibility.
• Commitment to an inclusive work environment valuing diverse perspectives.