SpaceXSI is seeking an Application Security Engineer to help safeguard the security and integrity of payments and financial products throughout the software development lifecycle. This onsite role in Washington, DC focuses on strengthening application security controls across code, CI/CD pipelines, threat modeling, vulnerability management, and security tooling, including SBOMs and agentic or LLM-based approaches.

Key Responsibilities

Run in-depth code reviews and static analysis to identify, assess, and mitigate security vulnerabilities in financial applications
Design and implement secure coding guidelines and best practices for development teams
Work with development teams to incorporate security practices throughout the CI/CD pipeline
Conduct threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, developing mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits
Own vulnerability tracking and remediation efforts, providing guidance to engineering teams
Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure
Support application security incident response activities
Monitor emerging threats targeting financial and cloud-native systems and continuously improve security controls
Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs)
Design and implement agentic and LLM-based solutions to detect, investigate, or prevent security issues

Required Qualifications

Bachelor’s degree in Computer Science, Cybersecurity, or a related field
3-5 years of experience in application security, with a strong focus on code security practices
Experience in payments, money transmission, digital wallets, or related financial platforms
Strong understanding of secure coding practices, application security frameworks, and common vulnerabilities (including OWASP Top 10)
Proficiency in Python or Rust, plus secure coding experience in these languages
Experience securing CI/CD pipelines and applying DevSecOps practices
Familiarity with software supply chain security and SBOM generation tools
Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis
Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues
Experience designing and implementing agentic and LLM-based solutions for security problems
Excellent communication skills, able to explain complex security topics to technical and non-technical audiences

Technologies

Python, Rust
OWASP Top 10
Burp Suite, OWASP ZAP
SBOMs and SBOM generation tools
DevSecOps
Agentic solutions, LLM-based solutions
CI/CD pipelines

Compensation and Benefits

$100,000 - $258,000 USD per year
Equity
Comprehensive medical, vision, and dental coverage
Access to a 401(k) retirement plan
Short & long-term disability insurance
Life insurance
Various other discounts and perks

Preferred Skills and Experience

Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus
Relevant security certifications (e.g., BSCP, OSCP, OSWE)
Experience managing bug bounty programs
Background in data privacy and compliance relevant to financial products and cloud-native applications
Experience with GitOps and infrastructure-as-code security
Experience building custom security tooling to enhance and automate security processes
Contributions to open-source security projects or tools

ITAR Requirements

To conform to U.S. Government export regulations, applicants must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.

Application Security Engineer