# Senior Application Security Engineer

**Company:** [BioRender](https://hotfix.jobs/companies/biorender)
**Location:** Remote
**Role:** Security Engineering
**Experience:** 5+ years
**Skills:** Node.js, React, Python, Terraform, AWS, Cloudflare, SAST, DAST, Sca, CI/CD, Owasp, Hackerone, Cryptography, Pki, Tls
**Posted:** 2026-07-21

> The Senior Application Security Engineer builds security tooling and production code, embeds secure-by-design practices, leads threat modeling, and protects AI-integrated features. The role requires strong web application security, software engineering, CI/CD security, AWS, and infrastructure-as-code experience.

## Job Description

## Responsibilities

### Hands-on engineering and codebase contribution
- Contribute production-quality code directly to the application using **Node.js** and **React**, and to infrastructure using **Python** and **Terraform**.
- Build and maintain security and CI/CD tooling, keeping the secure path the default path.
- Review RFCs and design documents for security and pair with engineers to resolve issues at the source.

### Architecture, design, and Secure SDLC
- Define secure-by-design patterns and standards for authentication, authorization, and API security.
- Lead threat modeling and turn models into shipped controls.
- Own and evolve Secure SDLC and CI/CD security integrations, including SAST, DAST, SCA, and secrets scanning.

### AI-native security and automation
- Use AI coding assistants and agentic tooling for code review, triage, and tooling development.
- Secure AI-integrated product features against prompt injection, data leakage, and over-scoped tool, token, and data access.
- Automate recurring security work so the team scales through leverage.

### Web and product security
- Perform penetration testing and Node.js/React code reviews using OWASP methodology.
- Identify and remediate application security vulnerabilities through SAST, DAST, and HackerOne.
- Own the bug bounty program, including issue evaluation, reproduction, and resolution through shipped fixes.

## Requirements
- Demonstrable software engineering ability, including fluency reading code and writing production-quality code in real codebases.
- Experience with **Node.js** and **React**; **Python** experience is a plus.
- Fluency with AI development tools, including AI coding assistants and agentic workflows.
- Expertise in web application security and secure-coding best practices.
- Experience integrating and maintaining SAST/DAST systems within CI/CD and with Secure Software Development Lifecycles.
- Hands-on experience securing cloud workloads on **AWS** and working with infrastructure as code such as **Terraform**.
- Threat-modeling experience and knowledge of common code and network vulnerabilities, their impact, and remediation.
- Applied knowledge of cryptography, PKI, and TLS and their practical implementation.

## Nice to have
- Experience hardening LLM-integrated or AI-powered features in production.
- Experience operating a bug bounty program, such as HackerOne.
- Contributions to SOC 2 control design and audit readiness from the engineering side.
- OSCP, OSWE, or AWS Security Specialty certification.
- Familiarity with **Cloudflare**.

## Similar jobs

- [Senior Security GRC Analyst](https://hotfix.jobs/jobs/b54fb115-3bb7-4d88-8fdc-b7901d26d90d) - Monarch - Remote - $180k – $215k/yr
- [Senior Security Support Analyst](https://hotfix.jobs/jobs/8dd54fca-ab77-4ee7-936d-4ff2b036df8e) - Coalition Security - Remote - $94k – $140k/yr
- [Cyber Operations Strategist, Critical Harm Operations](https://hotfix.jobs/jobs/ece80caf-f436-4708-91ae-1210a00dfaeb) - OpenAI - Remote - CA$140k – CA$188k/yr
- [Senior Detection Engineer II](https://hotfix.jobs/jobs/bc6380b5-c412-4bf8-a9b0-af8410baa07c) - Instacart - Remote - $192k – $243k/yr
- [Senior Manager, Product Security Engineering](https://hotfix.jobs/jobs/8fa92a96-1812-406c-8ae5-324c42e42eea) - GitLab - Remote - $168k – $245k/yr

**Apply:** https://hotfix.jobs/jobs/b836b07a-5727-496c-a31f-2c67526e8602
**Canonical:** https://hotfix.jobs/jobs/b836b07a-5727-496c-a31f-2c67526e8602