Security Engineer, Application Security
Security Engineer focused on application and platform security, security reviews, threat modeling, vulnerability management, and secure development practices. The role requires at least two years of relevant experience, programming ability, and familiarity with cloud security technologies.
About the job
Responsibilities
- Mature Sentry’s security review program, including secure code reviews, architecture reviews, and threat modeling.
- Build processes, tooling, and culture that integrate security into software delivery.
- Contribute to vulnerability management, including intake, triage, prioritization, remediation tracking, bug bounty, and responsible disclosure.
- Partner with product and engineering teams to embed secure-by-design principles early in development.
- Integrate security tooling into developer and CI/CD workflows.
- Scan, manually test, reproduce, and validate application and infrastructure security findings.
- Support penetration testing and vulnerability validation across applications, SDKs, and cloud platforms.
- Evaluate and respond to emerging application-security threats, including risks associated with agentic product features and AI-assisted engineering.
- Automate scalable security solutions and drive work end-to-end in a collaborative engineering environment.
Requirements
- 2+ years of industry experience designing, building, or securing complex applications and cloud systems.
- Degree in Computer Science or a related field, equivalent training, or professional experience.
- Hands-on experience with several of: security reviews, SDLC practices, secure CI/CD, architecture reviews, threat modeling, vulnerability management, bug bounty programs, and responsible disclosure programs.
- Comfortable programming in at least one language and reading and reasoning about Python, TypeScript, Go, or Rust code.
- Familiarity with distributed cloud technologies and how they are secured, including cloud networking and IAM.
- Strong written and verbal communication and a collaborative approach to problem solving.
Compensation
- Base salary range: $162,000–$420,000 CAD annually.
- Eligible for incentive compensation, equity grants, paid time off, and group health insurance coverage.
Skills
Application Security, Threat Modeling, Vulnerability Management, Secure Code Review, CI/CD, Python, TypeScript, Go, Rust, AWS, GCP, Azure, Kubernetes, Docker, Terraform
Similar jobs
Security Engineering jobs
Sentry
San Francisco, CASecurity engineer responsible for detection engineering, investigations, incident response, identity and access management, and preventative security controls across corporate and production environments. Requires 2+ years of security engineering experience, programming ability, and familiarity with cloud and defensive security tooling.
Harvey
San Francisco, CA
Build and operate foundational security services spanning identity, access, secrets, privileged access, and secure AI-agent infrastructure. The role requires at least two years of production software engineering experience, cloud expertise, and experience translating security requirements into reliable automated systems.
Flexport
San Francisco, CA
Build and operate corporate security controls across identity, endpoints, SaaS applications, and automation. The role requires 2–5 years of security engineering experience, hands-on endpoint and EDR expertise, identity protocol knowledge, and scripting ability.
Greptile
San Francisco, CA
Build Greptile’s security product, including code scanning, vulnerability detection and reproduction, security-focused pull-request workflows, and agent infrastructure. The role requires a computer science degree, software or DevOps experience, JavaScript/TypeScript expertise, and hands-on security experience.
Hover
San Francisco, CABuild foundational security services and automation protecting Hover’s applications, users, and cloud infrastructure. The role suits an early-career software engineer with strong programming fundamentals, a computer science background, and interest in secure development practices.