# Security Engineer, Application Security

**Company:** [GameChanger](https://hotfix.jobs/companies/gamechanger)
**Location:** Remote
**Role:** Security Engineering
**Salary:** $120k – $140k/yr
**Experience:** 3+ years
**Skills:** AWS, Kubernetes, Terraform, GitHub Actions, TypeScript, Swift, Kotlin, iOS, Android, REST APIs, GraphQL, Owasp Top 10, Web Application Firewalls, CI/CD, Policy As Code
**Posted:** 2026-08-18

> The Security Engineer will lead application security across the SDLC, integrating DevSecOps controls, conducting threat modeling and secure code reviews, and managing application vulnerabilities. The role requires 3+ years of application security experience plus hands-on expertise with AWS, Kubernetes, IaC, CI/CD, and mobile or web security.

## Job Description

## Responsibilities

### Application Security
- Embed security into every phase of the software development lifecycle.
- Champion security requirements for the responsible and secure integration of generative AI and agentic AI tools within the product stack.
- Conduct security-by-design engagements for new features, APIs, platform initiatives, and infrastructure changes.
- Perform secure code reviews and provide clear, actionable findings with remediation guidance.
- Partner with architecture and platform teams to establish secure REST and GraphQL API patterns.
- Maintain secure coding guidelines, API security standards, and security architectural patterns as paved roads for engineering teams.
- Provide code review feedback, write durable documentation, and conduct workshops or lunch-and-learns for engineers.

### DevSecOps
- Integrate and maintain security tooling across CI/CD pipelines.
- Enforce security quality gates in delivery pipelines.
- Harden CI/CD platform components, including GitHub Actions and runner environments.
- Identify opportunities to use AI for engineering productivity and agentic security workflows.
- Work with DevOps engineers to ensure AWS cloud infrastructure is securely defined and deployed using infrastructure as code.
- Implement and validate security controls for containerized workloads.
- Support application-layer network security controls, including Web Application Firewalls and CDN security.

### Vulnerability and Risk Management
- Operate the application vulnerability management lifecycle.
- Triage and prioritize findings from GHAS, NowSecure, Wiz, BugCrowd, penetration tests, and other sources based on business impact and exploitability.
- Identify systemic risks and facilitate cross-functional initiatives addressing root causes.
- Track security KPIs such as MTTR, vulnerability density, and CI/CD security coverage.
- Translate security metrics and risks into actionable insights for engineering and business leadership.
- Communicate security risk clearly to engineering and business leaders.
- Participate in a weekly on-call rotation.

## Requirements
- 3+ years of experience in application security engineering.
- Experience building and operating internal security developer platforms or tooling that reduces developer friction.
- Ability to use AI/ML-driven tools to improve security effectiveness and scalability.
- Experience leading threat-modeling engagements and designing paved roads.
- Proven track record integrating security tooling into CI/CD pipelines.
- Working knowledge of OWASP Top 10 for web, mobile, API, and LLM security.
- Hands-on experience securing AWS deployments with container and Kubernetes security, infrastructure-as-code scanning, and policy-as-code approaches.
- Expertise in security-by-design with TypeScript, Swift, and/or Kotlin.
- Experience implementing secure primitives in iOS and/or Android ecosystems.

## Nice-to-Haves
- AWS Certified Security – Specialty, CKS, GWEB, GMOB, or equivalent certification.

## Compensation and Benefits
- Target salary range: **$120,000–$140,000 USD**.
- Total compensation may include incentive compensation, equity, and benefits.
- Unlimited vacation policy.
- Paid volunteer opportunities.
- Technology stipend of $4,000 every two years after start.
- Annual WFH stipend of $500.
- Monthly physical, mental, wellness, and learning stipend.
- Monthly lifestyle stipend.
- Medical, dental, vision, prescription, FSA, HRA, HSA, and family/dependent coverage.
- Traditional and Roth 401(k) plans with immediate company match.
- Basic, supplemental, and dependent life insurance.
- Short-term and long-term disability leave.
- Company-paid parental leave of up to 20 weeks for birthing parents and 12 weeks for non-birthing parents.
- Family-building benefits.
- Teammate discount for DICK'S Sporting Goods and its family of brands.

## Similar jobs

- [Security Engineer](https://hotfix.jobs/jobs/b2d0b5eb-6441-418b-8992-e40ef5db3518) - DataVisor - Mountain View, CA - $120k – $150k/yr
- [Security Analyst, Third-Party Ecosystem Risk Management](https://hotfix.jobs/jobs/04d279a2-cca0-4b85-9c84-c8fb7b794013) - Plaid - New York, NY - $119k – $176k/yr
- [Security GRC Analyst](https://hotfix.jobs/jobs/e2503f84-7d16-49f3-9f64-65e03e688c69) - Pinterest - Remote - $124k – $255k/yr
- [Network Engineer](https://hotfix.jobs/jobs/43cf4905-eaf1-4ef4-b803-2668738d34a8) - Icarus - El Segundo, CA - $115k – $165k/yr
- [System Safety Engineer, Mining/Industrial](https://hotfix.jobs/jobs/644fb8c1-f6aa-4519-96c9-d8abfb23da9f) - Applied Intuition - Sunnyvale, CA - $125k – $225k/yr

**Apply:** https://hotfix.jobs/jobs/4ccb951f-6bd0-4244-8813-fa449cbf8f58
**Canonical:** https://hotfix.jobs/jobs/4ccb951f-6bd0-4244-8813-fa449cbf8f58