Sr. Security Engineer

About the role

ButterflyMX is seeking a Senior Security Engineer to join its growing security team. You will drive application security across the full software development lifecycle, build internal tooling, and partner with product and engineering teams to embed security from the start.

Key responsibilities

• Lead application security reviews, threat modeling sessions, and secure code reviews for new features and major product changes.
• Operate and continuously improve SAST, DAST, and SCA tooling, triaging findings with engineering teams.
• Plan and execute internal penetration tests against web applications, APIs, and mobile clients, and support third‑party assessments.
• Own the vulnerability management lifecycle from discovery through remediation validation.
• Integrate security tooling into CI/CD pipelines and champion shift‑left security practices.

Required profile

• 5+ years of experience in application security with hands‑on offensive testing.
• Strong understanding of web application and API security fundamentals (OWASP, MITRE, CIS).
• Experience in regulated environments such as SOC 2.
• Excellent written and verbal communication skills to translate technical risk to non‑technical stakeholders.

Required skills

• Python, JavaScript, Go, Ruby (or similar scripting languages).
• SAST, DAST, SCA tooling.
• Penetration testing of modern web and mobile applications.
• Cloud security (AWS preferred, GCP, OVH) and container/Kubernetes security.
• CI/CD pipeline integration and shift‑left security practices.

What we offer

• Base salary range $170,000‑$200,000 per year, with potential bonuses and equity.
• Comprehensive medical, dental, and vision coverage (80% covered by ButterflyMX).
• Generous paid time off: 10 holidays, 20 vacation days, 5 sick days, 3 floating holidays.
• Life, AD&D, disability, and family leave benefits fully covered by the company.
• Quarterly self‑care stipends and access to flexible spending accounts.