Senior Application Security Engineer

Overview

Senior Application Security Engineer on a small application security team at Sardine, securing a large multi-language, multi-cloud estate that processes financial risk and payment decisions, with depth in authorization and business logic flaws.

What you'll do

• Triage, validate, route, and drive remediation of findings from every source: SAST, DAST, SCA, code review, pentests, and bug bounty
• Build automation that removes manual effort from each vulnerability management step
• Set scope, direct external pentesters and the bug bounty program, judge severity, and close the loop
• Spot patterns across findings and remove root causes rather than individual instances
• Set secure patterns and defaults that make the right way the easy way
• Write custom static analysis rules for our own anti-patterns so fixed bug classes stay fixed
• Review platform-layer controls (authorization, service identity, secrets handling, gateway enforcement), find gaps, and push owning teams until they are closed
• Work alongside engineers on fixes that are simple, get adopted, and hold
• Perform hands-on testing of applications and APIs, and manual code review of high-exposure services, with depth in authorization and business logic
• Conduct threat modeling on new and high-exposure designs
• Provide security enablement across engineering, including a security champions program

What you'll need

• Experience running vulnerability management end to end and automating it with code against scanner, ticketing, and source-control APIs
• An engineering background: you have shipped and maintained real software, read unfamiliar code quickly, review it rigorously, and reason about architecture and failure modes
• Ownership to done, including fixes that depend on other teams
• Judgment over tenure: depth of judgment matters more than years of experience
• Code auditing in at least one of Go, Python, Node.js, Ruby, or Java, and willingness to work in the rest
• Practical command of the OWASP Top 10, with real depth in broken access control and business logic flaws
• SAST, DAST, and SCA in CI/CD, tuned so engineers trust the output
• Cloud fundamentals on GCP or AWS
• Docker and Kubernetes
• Ability to separate real findings from theoretical ones
• Disagree openly with evidence, and update when better evidence is presented
• Influence asynchronously across time zones, including with people who have strong opinions and no reporting line to you

Nice to have

• Scaling security tooling across many repositories, languages, and build systems
• Prior experience writing custom static analysis rules (Semgrep, CodeQL, or similar)
• Fintech, payments, or other environments under serious third-party security review (PCI DSS, SOC 2, customer audits)
• Fully distributed, asynchronous engineering experience
• Offensive experience in any form, such as pentesting on web, API, mobile, or cloud (most directly relevant), hardware and embedded work, physical security and lock sport, red team engagements, protocol and radio work, or CTF or bug bounty results
• Advanced offensive certifications: OSWE and BSCP are most relevant; CPTS, CRTO, and similar also count
• Public work: research, tooling, disclosures, talks

Details

• Location: Remote, United States
• Remote-first team across time zones; work from wherever helps you do your best work within your country of hire
• Pay is based on location; you must keep a home base in the country you are hired in