Security Engineer

What You’ll Do

• Lead application security assessments, including vulnerability scanning, code reviews, and threat modeling with engineering teams
• Partner closely with product and development squads to drive remediation and help teams understand and resolve security findings efficiently
• Integrate and scale automated security tooling across CI/CD pipelines (SAST, DAST, SCA, IaC) to shift security left
• Develop and maintain application security standards, patterns, and guardrails that reduce risk and support rapid delivery
• Drive threat modeling and risk assessments for new features, APIs, and services
• Collaborate with Cloud & Infrastructure Security to align security controls across layers and support cloud-native security requirements
• Support incident response for application-level security events and contribute to root-cause analysis and future mitigation strategies
• Help build internal training and awareness programs to elevate secure coding and developer security literacy
• Track and surface key security metrics, trends, and continuous improvement insights to leadership

What we're looking for

• 4–8+ years of experience in security engineering, application security, offensive security, or secure software development; strong track record of securing modern applications
• Hands-on experience with security tools such as Semgrep, Burp Suite, Snyk, Trivy, or similar for static, dynamic, and dependency security analysis
• Solid understanding of web, API, and mobile security vulnerabilities (e.g., OWASP Top 10, API Top 10)
• Experience driving or participating in threat modeling and secure design reviews
• Familiarity with cloud concepts and securing cloud workloads
• Collaborative mindset — you enjoy working closely with engineers to co-create practical security solutions
• Practical understanding of SDLC and integrating security into development workflows
• Ability to independently identify, prioritize, and drive remediation on critical findings
• Experience balancing security risk with business and technical constraints

Nice to have, but not mandatory

• Experience or exposure to runtime application protection (RASP) or advanced monitoring (e.g., eBPF-based tooling)
• Experience with cloud security automation frameworks such as Security Hub remediations or DLP improvements
• Security certifications like CISSP, CSSLP, OSCP, GWAPT, or similar
• Familiarity with compliance frameworks like SOC 2, ISO 27001, OWASP SAMM and aligning controls
• Prior experience in fintech, payments, or highly regulated environments
• Exposure to API security tooling and design best practices