Senior Application Security Engineer
Sardine · Remote · United States ·
COMPENSATION
$135k – $180k
Listed on the employer's job board (Ashby)
- Senior level role
- Fully remote (US)
- Go, Python, Java stack
- Kubernetes & Cloud
- Equity compensation
You will join a small application security team protecting a large estate of services running on Go, Node.js, Python, Ruby, and Java. Your primary focus is transforming vulnerability findings into an automated pipeline that validates and routes issues with minimal manual effort. You will work to remove entire classes of bugs by establishing secure defaults and patterns for engineering teams.
What you'll do
- Triage and validate findings from SAST, DAST, SCA, and bug bounty programs
- Build automation to reduce manual effort in vulnerability remediation
- Manage scope and severity for external pentests and bug bounty initiatives
- Identify patterns in findings to eliminate root causes rather than single instances
- Write custom static analysis rules to prevent recurring anti-patterns
- Review platform controls for authorization, secrets, and service identity
- Conduct hands-on testing and manual code reviews for high-exposure services
- Perform threat modeling on new designs and support security champions
What you'll need
- Experience automating vulnerability management end-to-end via APIs
- Strong engineering background with ability to read and review unfamiliar code
- Proficiency in code auditing for Go, Python, Node.js, Ruby, or Java
- Deep practical knowledge of OWASP Top 10, especially access control
- Experience tuning SAST, DAST, and SCA tools within CI/CD pipelines
- Familiarity with cloud fundamentals on GCP or AWS
- Knowledge of Docker and Kubernetes environments
- Ability to influence engineering teams asynchronously across time zones
Nice to have
- Experience scaling security tooling across multiple languages and build systems
- Background in writing custom static analysis rules using Semgrep or CodeQL
- Prior work in fintech or payments under PCI DSS or SOC 2 audits
- Offensive security experience in web, API, mobile, or cloud pentesting
- Holding advanced certifications such as OSWE, BSCP, or CPTS
- Public security research, tooling contributions, or conference talks
Stack
- go
- Node.js
- Python
- Ruby
- Java
- Kubernetes
- Docker
- AWS
- GCP
- SAST
- DAST
- SCA
How you'll work
- Fully remote within the United States
- Remote-first culture with flexible hours
- Home base required in the country of hire
- Asynchronous communication across time zones
What you get
- Generous cash compensation and equity package
- Early exercise option for all stock options
- Flexible paid time off and year-end break
- Health, dental, and vision insurance for US and Canada
- 4% matching for 401k or RRSP plans
- MacBook Pro provided to your door
- One-time home office setup stipend
- Monthly meal and social meet-up stipends
- Annual health, wellness, and learning stipends