Senior Application Security Engineer

Contribute production-quality code directly to the application (Node.js/React) and infrastructure (Python, Terraform) – you ship fixes and hardening yourself, not just findings for others to action.

Build and maintain security and CI/CD tooling for automation, keeping the secure path the default path.

Act as a security reviewer on RFCs and design documents, and pair with engineers to resolve issues at the source.

Define secure-by-design patterns and drive standards for authentication, authorization, and API security.

Lead threat modeling on new and existing systems and turn those models into shipped controls.

Own and evolve the Secure SDLC and CI/CD security integration (SAST/DAST/SCA/secrets) – tuned for high signal and low noise.

Work AI-natively: use AI coding assistants and agentic tooling to accelerate code review, triage, and tooling development.

Secure AI-integrated product features – reasoning about prompt injection, data leakage, and over-scoped tool, token, and data access.

Automate recurring security work so the team scales through leverage, not headcount.

Perform penetration testing and code reviews (Node.js/React) using OWASP methodology.

Drive identification and remediation of application security vulnerabilities (SAST/DAST/HackerOne).

Own the bug bounty program end to end – issue evaluation, reproduction, and closing findings by shipping fixes.

Demonstrable software engineering ability – you read code fluently, write production-quality code that engineers respect, and have contributed to real codebases (Node.js/React; Python a plus).

Fluency using AI development tools (AI coding assistants, agentic workflows) to get the job done, and a clear-eyed view of the security risks they introduce.