Application Security Engineer

About The Role

This position involves close collaboration with development teams rather than external auditing. The engineer will assess architectural plans prior to implementation, scrutinize code before deployment, and manage automated security scans integrated into the build pipeline. A significant responsibility includes converting common security issues into automated checks or libraries to prevent repeated vulnerabilities from reaching production environments.

Key Responsibilities

• Evaluate code and design proposals for potential security risks and implications.
• Manage and maintain the security scanning pipeline, ensuring it remains effective and minimizes false positives.
• Create automated safeguards for recurring security findings to preemptively catch vulnerabilities.

Requirements

• Proficient in reading and writing production-grade code in at least one programming language.
• Thorough understanding of common vulnerability types based on their underlying mechanisms, beyond just their names.
• Experience in delivering bug fixes that were maintained by other developers.

Preferred Qualifications

• Experience with threat modeling methodologies.
• Familiarity with security tooling such as Semgrep or CodeQL for writing security rules.
• Contributions to open source projects related to security or development.