Senior Application Security Engineer

What You’ll Do

• Design and implement secure-by-default platform controls, improving the security of our APIs and services.
• Build and evolve security systems and enforcement layers (e.g., gateways, middleware, policy engines) that operate at scale across distributed systems
• Define and standardize security patterns that can be broadly adopted across services, reducing the need for custom implementations
• Integrate security controls into developer workflows, infrastructure, and platform abstractions to drive high adoption
• Identify recurring security risks and translate them into reusable, enforced platform primitives
• Partner with engineering teams to influence system design and build out security that is embedded early in the development lifecycle
• Contribute to threat modeling and security reviews where needed, with a focus on turning findings into systemic improvements
• Leverage application telemetry (logs, traces, metrics) to assess security posture and drive improvements

Who You Are

• You have a strong background in software engineering and experience building distributed systems (Go or Python preferred)
• You have experience designing and implementing security controls or systems (e.g., authentication, authorization, API security, or infrastructure security)
• You have built shared infrastructure, internal platforms, libraries, frameworks, or enforcement mechanisms used by other engineering teams.
• You understand how modern systems handle identity, communication, and trust boundaries (e.g., mTLS, service identity, API gateways)
• You are comfortable operating in ambiguous environments and working across new problem spaces
• You make pragmatic security decisions that balance risk, usability, and scalability
• You are driven to not only identify security issues but also design and implement solutions that prevent them at scale

Nice to Have

• Experience with zero trust architectures or service-to-service security models
• Familiarity with policy-based systems or large-scale access control models
• Experience working with untrusted or non-deterministic workloads (e.g., sandboxing, agent-based systems)
• Experience using observability and telemetry to drive security insights and adoption