Application Security Engineer

Accountabilities:: Integrate and automate application security tools, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA), into CI/CD pipelines using platforms such as GitHub and GitLab. Design, implement, communicate, and maintain a developer-friendly Secure Software Development Lifecycle (Secure SDLC), incorporating security best practices and practical development guidelines. Conduct threat modeling exercises using established frameworks such as STRIDE to identify potential attack vectors, assess risks, and recommend appropriate mitigation strategies. Perform application security reviews and secure code assessments for Java and Python microservices, identifying vulnerabilities and providing actionable remediation guidance. Lead the management and continuous improvement of the private bug bounty program, including tracking program expenditure, triaging vulnerability reports, monitoring performance metrics, and reducing Mean Time to Mitigation (MTTM). Evaluate, configure, and optimize security tooling, including solutions such as GitHub Advanced Security, OWASP ZAP, Burp Suite, Synopsys, Veracode, and Semgrep. Establish and maintain security program metrics and key performance indicators (KPIs) to measure effectiveness, track remediation progress, and identify opportunities for improvement. Develop and deliver secure coding training, practical guidance, and awareness initiatives to help engineers integrate security into their daily workflows. Build and support a Security Champions network across Engineering, encouraging shared responsibility for security and strengthening collaboration between technical teams. Partner with internal stakeholders to manage vulnerability disclosures and contribute technical content, including security engineering blogs and communications that demonstrate security expertise. Collaborate with engineering teams to introduce scalable security guardrails while minimizing friction and supporting development speed and productivity. Stay informed about emerging application security threats, vulnerabilities, and industry best practices to continuously improve security processes and controls. Requirements: Three to five or more years of dedicated experience in application security and/or full-stack development, with demonstrated expertise in identifying and mitigating software vulnerabilities. Practical experience performing secure code reviews and application security assessments for Java and Python applications. Strong knowledge of application security tooling and hands-on experience integrating SAST, DAST, and SCA solutions into modern CI/CD pipelines. Familiarity with security tools and platforms such as GitHub Advanced Security, OWASP ZAP, Burp Suite, Synopsys, Veracode, Semgrep, or comparable technologies. Experience managing or operating bug bounty programs, including vulnerability triage, remediation coordination, budget tracking, and the definition and monitoring of program KPIs. Practical experience with threat modeling methodologies, particularly STRIDE, and the ability to apply structured risk analysis to complex applications and systems. Strong understanding of secure software development principles, vulnerability management, and methods for embedding security throughout the development lifecycle. Excellent communication and interpersonal skills, with the ability to build trusted relationships across Engineering and Security teams and explain complex security concepts clearly. A collaborative, developer-focused mindset and the ability to balance robust security controls with efficient software delivery. Strong analytical thinking, problem-solving skills, initiative, and a willingness to take ownership of security projects in a fast-paced environment. A bachelor's degree in a relevant discipline is desirable but not mandatory. Experience in cloud-native environments, high-growth technology companies, or fintech startups is an advantage. Hands-on familiarity with AWS security controls and cloud infrastructure is a plus. Ability to work effectively in a fully remote, globally distributed team, demonstrating autonomy, adaptability, and strong cross-functional collaboration. Benefits: Competitive annual salary: $175,000–$230,000, depending on qualifications, experience, and other relevant factors. Remote-first flexibility: Remote work opportunities, with hybrid arrangements for employees living within 30 miles of an office location. Flexible working hours: Greater autonomy to organize your schedule and support work-life balance. Health insurance: Medical, dental, and vision coverage. Health savings and flexible spending accounts: HSA and FSA options to help manage eligible healthcare expenses. Retirement savings: A 401(k) plan with a 4% employer match and immediate vesting for eligible US employees. Equity opportunities: Early equity participation. Flexible time off: Flexible paid time off and paid national holidays. Family support: A global parental leave program. Insurance protection: Life and disability insurance coverage, plus pet insurance. Internet stipend: Financial support for internet expenses. Home office support: An office setup stipend for eligible US employees. Learning and development: A learning stipend, internal advancement opportunities, and lunch-and-learn sessions. Team engagement: Team events, company summits, and opportunities to connect with colleagues. Office perks: Weekly office lunches for employees attending in person. Employee discounts: Access to an employee discount platform. Meaningful technical impact: The opportunity to shape application security practices and help protect large-scale payment infrastructure.