Location: United States or Canada — Remote
Employment Type: Full-time
Salary: USD 150,000–230,000 per year + equity

About the company

Our client is a fast-growing technology company developing an innovative SaaS platform used by customers across highly regulated industries.

The company combines technology, artificial intelligence, and a strong product-driven culture to solve complex challenges at scale. Its engineering teams work in a fast-paced and highly collaborative environment, with a strong focus on innovation, security, and product quality.

About the role

We are looking for a Senior Application Security Engineer with more than six years of experience to join a small but high-impact security team.

This is a hands-on engineering role for someone who combines deep application security expertise with strong software development capabilities. The successful candidate will be comfortable reading and writing code, implementing production-ready security fixes, and working directly with engineering teams to build security into the product.

Rather than only identifying vulnerabilities and assigning remediation work to developers, this person will be expected to investigate issues, develop solutions, and ship fixes directly to production.

The role also involves using AI-powered tools and automation to reduce manual security work and enable the team to focus on broader security architecture and high-impact initiatives.

Key responsibilities

• Contribute production-quality code directly to the application using Node.js and Python.
• Investigate vulnerabilities and personally implement security fixes and application-hardening features.
• Build AI-powered automation for security processes, including pull request analysis and vulnerability triage.
• Manage the HackerOne bug bounty program from end to end.
• Evaluate bug bounty submissions, reproduce reported issues, determine their severity, and coordinate or implement remediation.
• Define secure-by-design patterns and establish application security standards across the organization.
• Review the security of AI-powered and AI-integrated product features.
• Participate as a security reviewer in RFCs, technical proposals, and application design documents.
• Conduct security-focused code reviews and architecture assessments.
• Partner closely with software engineers to identify and resolve security issues at their source.
• Help integrate security controls and best practices throughout the software development lifecycle.

Qualifications and experience

• Six or more years of professional experience in Application Security, Product Security, or a closely related engineering-focused security role.
• Previous experience as a Software Engineer, Backend Engineer, Full Stack Engineer, or equivalent hands-on software development experience.
• Strong ability to read, write, test, and maintain production-quality code.
• Advanced programming experience with Node.js and/or Python.
• Experience identifying, reproducing, and remediating application vulnerabilities.
• Strong understanding of secure coding, threat modeling, OWASP principles, authentication, authorization, API security, and vulnerability management.
• Experience working directly with software engineering and product development teams.
• Experience reviewing source code, technical designs, and application architectures from a security perspective.
• Strong written and verbal communication skills in English.
• Ability to work independently and take ownership within a small, fast-moving team.

Education

• Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, Information Security, or a related technical field is preferred.
• Equivalent professional experience and demonstrated hands-on engineering expertise will also be considered.
• Relevant application security or cloud security certifications are valued but not required.

Technology stack

• Node.js
• Python
• AWS
• Terraform
• AI-powered security tooling
• CI/CD and security automation

Preferred qualifications

• Experience managing or contributing to a bug bounty program, ideally through HackerOne.
• Experience personally shipping security fixes to production.
• Knowledge of infrastructure as code and cloud security in AWS environments.
• Experience automating application security controls within CI/CD pipelines.
• Familiarity with security considerations for AI-powered products or LLM-based functionality.
• Experience working in a high-growth SaaS company or product-focused technology startup.
• Experience supporting products used by customers in regulated industries.

What the company offers

• Competitive base salary ranging from USD 150,000 to USD 230,000 annually, depending on experience and seniority level.
• Competitive equity package.
• Fully remote work within the United States or Canada.
• The opportunity to join a small, highly influential security team.
• Direct ownership of security initiatives and production-level solutions.
• The ability to shape application security standards and architecture across the organization.
• Close collaboration with talented engineering and product teams.
• The opportunity to work with modern technologies, AI-powered solutions, and complex security challenges.
• A high-impact role within a fast-growing and innovative technology company.

Location and work authorization

This is a fully remote position open exclusively to candidates currently residing in the United States or Canada.

Candidates must already have valid authorization to work in their country of residence. The company does not provide visa sponsorship or relocation assistance.