About this role
Job location: Remote About the role: We are looking for an Application Security Engineer to own the end-to-end security posture of our product platform — spanning mobile applications, REST APIs, microservices, cloud infrastructure, and third-party integrations. In this role, the Application Security Engineer will be involved into the product and engineering lifecycle early, shaping secure design decisions before code is written, and validating them through rigorous assessment. ● Own application security responsibility for assigned business functions by performing threat modeling, architecture reviews, penetration testing, secure coding programs, and vulnerability management. ● Perform manual penetration testing and vulnerability assessments on web applications, APIs, and android mobile applications. ● Perform security reviews for AI‐native products, models, pipelines, and inference services. ● Onboard applications into the SSDLC program and be a security point of contact for the application product. ● Own security incident response for product-layer issues, define remediation plans, and track fixes through to closure. ● Integrate and tune SAST/DAST/IAST/SCA tools in CI/CD, create custom rules where needed and actively triage false positives. ● Review and harden cloud infrastructure — Kubernetes RBAC, pod security, network policies, Istio service mesh, Keycloak/OIDC configurations, and IAM across AWS, DigitalOcean, GCP, and Firebase. ● Communicate vulnerabilities and risk clearly to developers, product managers, and leadership — in language that drives actionable results. ● Conduct application security training for engineers, product managers etc.