Senior Application Security Engineer (Remote)

We are recruiting to fill the position below:

Job Title: Senior Application Security Engineer

Location: Remote

About the role

• The ideal candidate is a technical leader who blends deep security expertise with exceptional influence.
• You possess broad security knowledge anchored by specialization in critical areas, and excel at translating complex risks into actionable insights for both engineers and executives. Your strength lies in harmonizing diverse perspectives, strategically prioritizing risks, and guiding partners to implement resilient, secure solutions that balance speed and safety.
• As a Senior Application Security Engineer, you will champion secure innovation by embedding security into the fabric of our software development lifecycle.
• You'll partner closely with engineering teams to safeguard customer trust while they build cutting-edge services. Your expertise will directly shape secure design through threat modeling and code review, drive efficiency via security automation, and mentor developers to elevate our collective security posture.

Key Responsibilities
Security Strategy & Leadership:

• Mentor engineers technically and professionally, fostering a culture of security excellence.
• Lead threat modeling, security architecture reviews, and design guidance for diverse software projects.
• Define and execute security strategy for product teams, aligning with business objectives.

Advanced Technical Execution:

• Perform manual/automated secure code reviews across Java, Python, JavaScript, and cloud-native stacks.
• Develop security automation tools to scale vulnerability detection (SAST/DAST/IAST enhancements).
• Conduct adversarial security analysis using automated tools and manual techniques (e.g., custom exploit development).

Risk Mitigation & Innovation:

• Solve novel security problems lacking predefined solutions (e.g., zero-day vulnerabilities, emergent attack vectors).
• Identify complex risks through offensive security research; advocate for cutting-edge mitigation technologies.
• Maintain and evolve threat models for critical applications and microservices architectures.

Collaboration & Enablement:

• Design/deliver security training programs tailored to development teams and business stakeholders.
• Lead incident response for application security events and drive root-cause analysis.
• Partner with the engineering team to embed security controls into CI/CD pipelines and development practices.

Qualifications Required

• 5+ years in application security, including 2+ years in a senior/lead role.
• Proven track record in security architecture design and risk-based decision-making.
• Expertise in threat modeling (e.g., STRIDE, PASTA), penetration testing, and secure SDLC implementation.Proficiency in code review for Java/Python/JavaScript and cloud platforms (AWS/Azure/GCP).
• Hands-on experience building security tools (e.g., scanners, CI plugins) with Python/Go.

Preferred:

• OSCP, OSCE, GXPN, or similar offensive security certifications.
• Experience with container security (Kubernetes, Docker), serverless, or infrastructure-as-code.
• Contributions to security tooling/open-source projects.

Skills:

• Communication: Translate technical risks to business impact for executives and engineers alike.
• Technical Depth: Mastery of application security frameworks (OWASP, NIST) and exploit techniques.
• Innovation: Aptitude for researching/implementing novel solutions to ambiguous security challenges.
• Leadership: Ability to define team strategy, mentor engineers, and influence stakeholders.
• Execution: Drive implementation of security controls