Senior Application Security Engineer

About the role

We are looking for a Senior Application Security Engineer to join Savvy’s New York headquarters as our first dedicated security hire. In this hands‑on role you will execute the security strategy defined by leadership, focusing on vulnerability management, secure development practices, and safeguarding our AI‑driven SaaS stack.

Key responsibilities

• Own end‑to‑end vulnerability management across product codebases and cloud infrastructure (AWS, GCP, Cloudflare).
• Build and operate the AppSec tooling pipeline, including secrets scanning, SCA/dependency scanning, and SAST rollout in CI/CD (GitHub‑centric).
• Define and enforce security hygiene standards, especially for AI‑generated code, and partner with the internal AI team to create safe development guardrails.
• Secure SaaS environments by hardening configurations, reviewing OAuth grants, and implementing least‑privilege access for tools such as Google Workspace, GitHub, Rippling, and Slack.
• Collaborate with Engineering, IT, and AI teams to communicate risk, remediation paths, and trade‑offs to both technical and non‑technical stakeholders.

Required profile

• 5+ years of hands‑on security engineering experience with a focus on application or product security.
• Strong software engineering fundamentals and ability to read, write, and remediate code.
• Deep experience with modern AppSec toolchains (secrets scanning, SCA, SAST) and CI/CD integration.
• Practical knowledge of cloud security (AWS and/or GCP) and edge/CDN security (Cloudflare).
• Proven track record of embedding security into existing workflows without slowing delivery.

What we offer

• Competitive salary and equity package.
• Unlimited PTO plus paid company holidays.
• Comprehensive medical, dental, and vision benefits.
• 401(k), commuter, and HSA/FSA plans.
• NYC office in Manhattan with lunch and snacks.
• Access to virtual mental‑health care and a full employee assistance program.