Security Engineer (Application & Product Security)

Quick Facts

• Role: Security Engineer focused on Application and Product Security

Description

You will strengthen the security posture of applications, services, and the development ecosystem by integrating security into the software development lifecycle. You will collaborate with engineering teams to build secure-by-default patterns, enable automated security checks in CI/CD, and guide secure design and remediation. You will also improve security controls through assessments, automation, and continuous program improvement.

Responsibilities

• Integrate application security best practices into the development lifecycle with engineering partnerships and automated CI/CD security checks
• Support application security tooling, including SAST, DAST, SCA, and secrets scanning; help developers interpret and remediate findings
• Perform secure code reviews, threat modeling, and application architecture assessments; propose mitigation strategies
• Develop and maintain security automation, guardrails, and reusable components
• Help define and improve secure coding standards and application hardening practices
• Improve application-level logging, telemetry, and alerting to support monitoring and detection
• Assist incident response for application vulnerabilities (verification, triage, remediation support)
• Stay current on emerging threats, vulnerabilities, and application/product security best practices
• Contribute to security documentation such as requirements, guidelines, and remediation playbooks
• Participate in internal security reviews, compliance-driven assessments, and architectural walkthroughs
• Develop and maintain application security tools, pipelines, and workflows
• Collaborate with engineering and product teams to ensure secure deployment and continuous improvement

Requirements

• Bachelor’s degree in Computer Science, Engineering, MIS, or equivalent practical experience
• 2–5 years of experience in application security, product security, or security-focused software engineering
• Strong understanding of application vulnerabilities and mitigation strategies (OWASP Top 10, CWE)
• Experience with CI/CD tooling, Git-based workflows, and modern development practices
• Cloud security knowledge and hands-on experience with AWS, Azure, or GCP
• Programming experience in one or more languages (Java and Python preferred)
• Experience with application security tools (OWASP ZAP, Burp Suite, SAST/DAST tools, SCA, dependency scanning)
• Knowledge of secure coding, API security, authentication, authorization, and secrets management
• Strong problem-solving skills and clear technical communication to developers and stakeholders
• Understanding of agile development processes
• Ability to travel ~25% in person for onboarding, team events, and other company engagements