Senior Security Engineer, Application Security

Accountabilities: Lead security initiatives from planning through implementation across cloud infrastructure hardening and application security, including complex projects with evolving requirements. Own and maintain technical security controls supporting compliance frameworks such as PCI DSS, including ASV scanning, network security control reviews, and tamper-detection monitoring. Deploy, configure, and optimize infrastructure protections against application exploitation, account takeover, and denial-of-service attacks. Define security architecture and conduct threat modeling for AI-powered products, including voice and chat agents with access to calendars and user accounts. Review technical proposals, product requirements, and merge requests from a security perspective, partnering directly with product and engineering teams during the design and development of new features. Develop security tooling, automation, and engineering frameworks that make secure implementation the easiest path for development teams. Mentor engineers across teams and identify opportunities to improve security practices, recurring incident patterns, tooling gaps, and inefficient processes. Participate throughout the incident response lifecycle, including involvement in a 24/7 on-call rotation. Continuously evaluate and integrate AI-driven tools into security workflows, using AI-assisted coding and security solutions to improve efficiency and effectiveness. Provide security guidance and practical recommendations that balance risk reduction, product usability, and engineering delivery. Requirements: 5+ years of experience in security engineering, with experience across at least two of the following areas: application security, cloud or infrastructure security, and enterprise security. Hands-on experience with AWS and infrastructure-as-code tools such as Terraform, CloudFormation, or equivalent technologies. Ability to read, review, and contribute to product or service code; experience with Kotlin, Next.js, Python, Ruby, Scala, or Swift is preferred. Strong understanding of the OWASP Top 10 and practical approaches to identifying and remediating common application vulnerabilities. Familiarity with authentication and authorization standards, including OAuth, OpenID Connect (OIDC), and SAML. Exposure to security risks in LLM and agentic systems, including prompt injection, agent identity, and data exfiltration through AI-powered applications. Regular, practical use of AI-assisted coding and security tools, with the ability to explain how you guide, validate, and verify AI-generated output. Strong written communication skills, including experience producing threat models and providing clear security feedback on design documents and merge requests. Experience implementing the technical controls required by compliance frameworks such as PCI, SOX, or similar standards, including vulnerability scanning, control reviews, and tamper detection. Familiarity with application security tools such as Snyk, Veracode, or Fortify; infrastructure vulnerability scanners such as Qualys, Tenable, or Rapid7; and penetration testing tools such as Burp Suite or OWASP ZAP is preferred. Experience with containers and Kubernetes is an advantage. Strong problem-solving skills, sound technical judgment, and the ability to work independently while collaborating effectively with distributed teams. Candidates based in Eastern or Central US time zones are preferred. Benefits: Annual base salary range of $150,000–$225,000, depending on experience, performance, and geographic location. Eligibility for a competitive year-end performance bonus and equity package. Comprehensive medical, dental, and vision insurance options. Flexible vacation policy, allowing employees to take time off when needed. Pet discount plans. 401(k) retirement plan with company matching contributions. Opportunity to collaborate with talented, motivated colleagues on complex security challenges in a dynamic technology environment. Fully remote work arrangement within the United States.