RemoteLeaf Logo
Log in Sign up

Staff Application Security Engineer (R5949)

3 weeks ago
Anywhere
Full-time
Lead
Application Security Engineer
Cybersecurity
Burp Suite DevSecOps Kubernetes Microservices SonarQube
Apply Now
Bitly

Bitly

Bitly is a link management platform offering URL shortening, QR codes, and a Link in Bio solution for brands to optimize customer experience.

Internet Software & Services
51-250
Founded 2008
$92M raised
View All Jobs 19

Description

  • Establish and continuously improve company-wide secure SDLC policies, standards, controls, procedures, and evidence requirements.
  • Assess engineering, CI/CD, source-control, build, and release maturity and lead improvement roadmaps.
  • Develop secure-development guidance, reference architectures, reusable patterns, guardrails, exception processes, and enablement materials.
  • Partner with development teams to triage, prioritize, remediate, and verify application-security findings.
  • Implement and operationalize SAST, DAST, SCA, secrets detection, infrastructure-as-code, container, API, and cloud-native security controls.
  • Lead threat modeling, security requirements definition, and secure design reviews for high-risk applications and changes.
  • Establish risk-based vulnerability, third-party dependency, open-source governance, and software supply-chain security processes.
  • Secure CI/CD pipelines through least-privilege access, protected branches, secret handling, hardened build environments, and release approvals.
  • Create and lead a security champions program with training, office hours, secure-coding guidance, and developer tools.
  • Develop executive metrics and reporting covering AppSec risk, remediation, control coverage, supply-chain integrity, and program maturity.

Requirements

  • 7+ years of experience in application security, product security, DevSecOps, secure software engineering, cybersecurity engineering, or a related field.
  • Experience designing, implementing, or maturing secure SDLC or application-security programs across multiple engineering teams.
  • Strong knowledge of secure coding, application-security testing, vulnerability management, software delivery, and DevSecOps.
  • Hands-on experience with SAST, DAST, SCA, dependency vulnerability management, secrets scanning, and related tools.
  • Experience integrating security controls into source-control, CI/CD, build, release, and deployment workflows.
  • Experience facilitating threat modeling, security design or architecture reviews, and security requirements definition.
  • Knowledge of common application-security risks, including authentication, authorization, API security, injection, insecure dependencies, secrets exposure, and business-logic vulnerabilities.
  • Experience with SBOMs, dependency provenance, build integrity, artifact signing, release attestations, and secure artifact management.
  • Familiarity with NIST SP 800-218/SSDF, OWASP SAMM, SLSA, or comparable frameworks; preferred experience includes NIST SP 800-171, NIST SP 800-53, CMMC, FedRAMP, ISO 27001, or SOC 2.
  • Ability to assess production code in a modern programming language and communicate technical risks to technical and nontechnical stakeholders; relevant certifications and experience with cloud-native, Kubernetes, API, IaC, or AppSec tools are preferred.

Benefits

  • Full-time package includes salary within the listed range, bonus, benefits, and equity.
  • Temporary employees receive pay within the listed range and a temporary benefits package after 60 days.
  • Offers may be influenced by experience, skills, certifications, licenses, and work location.
  • Equal opportunity workplace with reasonable accommodations available for disabilities or special needs.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Coforge

Analista de Seguridad de Aplicaciones Mid

Coforge 10K-50K IT Services

Coforge busca un Analista Mid de Seguridad de Aplicaciones para analizar y fortalecer la seguridad de APIs, aplicaciones web y código durante el ciclo de desarrollo de software, en modalidad remota desde Lima, Perú.

Peru Mid Level Application Security Engineer
Azure Git GitHub
4 hours, 18 minutes ago
Trail of Bits

Security Engineer II, Application Security

Trail of Bits 51-250 Internet Software & Services

Trail of Bits is hiring a remote U.S.-based Security Engineer II to conduct hands-on application security assessments, discover and validate vulnerabilities, build custom tooling, and deliver actionable findings to clients.

United States Full-time Junior Application Security Engineer
$140k-$180k
Ansible C C++ Cybersecurity Go Helm JavaScript Kubernetes Python Rust Terraform TypeScript
4 hours, 48 minutes ago
Quanata

Staff Security Engineer [Remote-US]

Quanata 201-500 information technology & services

Quanata, LLC is seeking a Staff Security Engineer to secure AI-enabled systems, applications, cloud infrastructure, and platforms while shaping security standards and initiatives across the organization.

United States Full-time Lead Application Security Engineer
$290k-$400k
AWS CI/CD Cybersecurity DevSecOps Docker Generative AI GitHub Actions Go Java JavaScript Jenkins Kubernetes Machine Learning Python Secrets Management SIEM Terraform TypeScript
1 day, 4 hours ago
Chainguard

Senior Product Security Engineer

Chainguard 51-250 Internet Software & Services

Chainguard is hiring a security engineer to embed secure software supply chain practices into CI/CD and cloud-native product development, reducing risk across its Kubernetes, cloud, and open source software stack.

United States Full-time Senior Application Security Engineer
$157k-$184k
AWS CI/CD GCP GitHub Actions Go Kubernetes OWASP Penetration Testing Python Secrets Management Tekton
6 days, 4 hours ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers