About the company
This position is listed on behalf of a partner company, who manages all applications and next steps.
Responsibilities
- Perform hands-on security analysis of applications, APIs, services, and supporting components.
- Conduct secure code reviews across Java, Python, and Go codebases.
- Reproduce and validate vulnerabilities independently.
- Own vulnerability remediation from discovery through prioritization, remediation, retesting, and closure.
- Maintain remediation SLAs and escalate unresolved Critical and High findings.
- Develop reusable secure coding patterns, preventative controls, and automation.
- Mature security gates and review checkpoints.
- Integrate preventative security controls into developer workflows and CI/CD pipelines.
- Configure, operate, and tune SAST, DAST, and SCA tooling.
- Assess software dependency and supply-chain risks.
- Threat-model new features and significant architectural changes using STRIDE, PASTA, or equivalent methodologies.
- Review authentication, authorization, OAuth 2.0/OIDC, mTLS, rate limiting, data flows, trust boundaries, cryptographic controls, and abuse scenarios.
- Evaluate application security across AWS, Kubernetes/EKS, containers, Linux/Ubuntu, distributed services, and cloud-native architectures.
- Partner with Engineering as a technical advisor.
- Deliver secure-coding guidance and training.
- Help establish and mature a Security Champions program.
- Create security runbooks, standards, and reusable development patterns.
- Validate application and API vulnerabilities through hands-on testing.
- Drive first-year improvements in vulnerability remediation, threat modeling, dependency security, secure development practices.
Requirements
- 7+ years of progressive experience in Application Security, Product Security, security-focused software engineering, or a closely related field.
- Demonstrated senior-level ownership of Application Security initiatives and vulnerability remediation.
- Strong hands-on coding and secure code review experience with Java, Python, and Go.
- Ability to read, debug, and reason about production application code.
- Proven ability to reproduce vulnerabilities, trace findings to root cause, assess exploitability and reachability, and validate remediation.
- Hands-on experience with SAST, DAST, and SCA tools.
- Strong knowledge of software dependency and supply-chain security.
- Experience prioritizing vulnerabilities based on application and business context.
- Strong understanding of the OWASP Top 10 and OWASP API Security risks.
- Experience with threat modeling using STRIDE, PASTA, or similar methodologies.
- Experience securing cloud-native applications running in AWS and Kubernetes/EKS environments.
- Strong communication and collaboration skills.
- Hands-on application and API penetration-testing experience is preferred.
- Experience in financial services, fintech, identity, fraud, regulated SaaS, or other highly regulated environments is a plus.
- Familiarity with PCI-DSS application security requirements is preferred.
- Experience building or leading a Security Champions program is a plus.
- Experience developing Application Security automation or internal security tooling is desirable.
- OSCP, GWEB, CSSLP, or a similar technical security certification is preferred.
Conditions