Staff Security Engineer, Application Security

About the role

We are looking for a Staff Security Engineer to lead and expand our application security program. This hands‑on, high‑leverage position will serve as the technical authority for building secure software across the product lifecycle.

Key responsibilities

• Lead security architecture reviews and threat modeling for new features and major system changes, partnering with engineering and product from design through launch.
• Own the secure SDLC program, including static and dynamic analysis (SAST/DAST), software composition analysis, secrets scanning, and CI/CD security gates.
• Perform deep‑dive code reviews and manual penetration testing of high‑risk services, APIs, and web applications.
• Design and build internal security tooling and guardrails that enable engineers to move fast without introducing risk.
• Run and mature the vulnerability management program, handling triage, severity scoring, and remediation coordination.
• Manage relationships with external pentest vendors and bug bounty programs, turning findings into durable fixes.
• Set technical direction on authentication, authorization, API security, and data‑protection patterns used across the product.
• Mentor engineers on secure coding practices and act as the go‑to resource for security questions.
• Contribute to incident response for application‑layer issues and help define the overall AppSec roadmap and metrics.

Required profile

• 7+ years of experience in security engineering with a recent focus on application security.
• Proven ability to lead security initiatives and influence product and engineering teams.
• Hands‑on experience conducting threat modeling, security architecture reviews, and penetration testing.
• Strong track record of building and operating secure SDLC processes and tooling.

Required skills

• SAST and DAST
• Software composition analysis
• Secrets scanning
• CI/CD security gates
• Penetration testing
• API security
• Authentication and authorization design
• Threat modeling
• Vulnerability management