Application Security Engineer

<h3>Accountabilities:</h3><li>Integrate and automate application security tools, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA), into CI/CD pipelines using platforms such as GitHub and GitLab.</li><li>Design, implement, communicate, and maintain a developer-friendly Secure Software Development Lifecycle (Secure SDLC), incorporating security best practices and practical development guidelines.</li><li>Conduct threat modeling exercises using established frameworks such as STRIDE to identify potential attack vectors, assess risks, and recommend appropriate mitigation strategies.</li><li>Perform application security reviews and secure code assessments for Java and Python microservices, identifying vulnerabilities and providing actionable remediation guidance.</li><li>Lead the management and continuous improvement of the private bug bounty program, including tracking program expenditure, triaging vulnerability reports, monitoring performance metrics, and reducing Mean Time to Mitigation (MTTM).</li><li>Evaluate, configure, and optimize security tooling, including solutions such as GitHub Advanced Security, OWASP ZAP, Burp Suite, Synopsys, Veracode, and Semgrep.</li><li>Establish and maintain security program metrics and key performance indicators (KPIs) to measure effectiveness, track remediation progress, and identify opportunities for improvement.</li><li>Develop and deliver secure coding training, practical guidance, and awareness initiatives to help engineers integrate security into their daily workflows.</li><li>Build and support a Security Champions network across Engineering, encouraging shared responsibility for security and strengthening collaboration between technical teams.</li><li>Partner with internal stakeholders to manage vulnerability disclosures and contribute technical content, including security engineering blogs and communications that demonstrate security expertise.</li><li>Collaborate with engineering teams to introduce scalable security guardrails while minimizing friction and supporting development speed and productivity.</li><li>Stay informed about emerging application security threats, vulnerabilities, and industry best practices to continuously improve security processes and controls.</li><h2>Requirements:</h2><li>Three to five or more years of dedicated experience in application security and/or full-stack development, with demonstrated expertise in identifying and mitigating software vulnerabilities.</li><li>Practical experience performing secure code reviews and application security assessments for Java and Python applications.</li><li>Strong knowledge of application security tooling and hands-on experience integrating SAST, DAST, and SCA solutions into modern CI/CD pipelines.</li><li>Familiarity with security tools and platforms such as GitHub Advanced Security, OWASP ZAP, Burp Suite, Synopsys, Veracode, Semgrep, or comparable technologies.</li><li>Experience managing or operating bug bounty programs, including vulnerability triage, remediation coordination, budget tracking, and the definition and monitoring of program KPIs.</li><li>Practical experience with threat modeling methodologies, particularly STRIDE, and the ability to apply structured risk analysis to complex applications and systems.</li><li>Strong understanding of secure software development principles, vulnerability management, and methods for embedding security throughout the development lifecycle.</li><li>Excellent communication and interpersonal skills, with the ability to build trusted relationships across Engineering and Security teams and explain complex security concepts clearly.</li><li>A collaborative, developer-focused mindset and the ability to balance robust security controls with efficient software delivery.</li><li>Strong analytical thinking, problem-solving skills, initiative, and a willingness to take ownership of security projects in a fast-paced environment.</li><li>A bachelor's degree in a relevant discipline is desirable but not mandatory.</li><li>Experience in cloud-native environments, high-growth technology companies, or fintech startups is an advantage.</li><li>Hands-on familiarity with AWS security controls and cloud infrastructure is a plus.</li><li>Ability to work effectively in a fully remote, globally distributed team, demonstrating autonomy, adaptability, and strong cross-functional collaboration.</li><h2>Benefits:</h2><li>
<strong>Competitive annual salary:</strong>$175,000–$230,000, depending on qualifications, experience, and other relevant factors.</li><li>
<strong>Remote-first flexibility:</strong>Remote work opportunities, with hybrid arrangements for employees living within 30 miles of an office location.</li><li>
<strong>Flexible working hours:</strong>Greater autonomy to organize your schedule and support work-life balance.</li><li>
<strong>Health insurance:</strong>Medical, dental, and vision coverage.</li><li>
<strong>Health savings and flexible spending accounts:</strong>HSA and FSA options to help manage eligible healthcare expenses.</li><li>
<strong>Retirement savings:</strong>A 401(k) plan with a 4% employer match and immediate vesting for eligible US employees.</li><li>
<strong>Equity opportunities:</strong>Early equity participation.</li><li>
<strong>Flexible time off:</strong>Flexible paid time off and paid national holidays.</li><li>
<strong>Family support:</strong>A global parental leave program.</li><li>
<strong>Insurance protection:</strong>Life and disability insurance coverage, plus pet insurance.</li><li>
<strong>Internet stipend:</strong>Financial support for internet expenses.</li><li>
<strong>Home office support:</strong>An office setup stipend for eligible US employees.</li><li>
<strong>Learning and development:</strong>A learning stipend, internal advancement opportunities, and lunch-and-learn sessions.</li><li>
<strong>Team engagement:</strong>Team events, company summits, and opportunities to connect with colleagues.</li><li>
<strong>Office perks:</strong>Weekly office lunches for employees attending in person.</li><li>
<strong>Employee discounts:</strong>Access to an employee discount platform.</li><li>
<strong>Meaningful technical impact:</strong>The opportunity to shape application security practices and help protect large-scale payment infrastructure.</li>