Application Security Engineer

Secure cloud-native applications from end to end while working with a team that values security, automation, and practical guidance across the development lifecycle. SpaceXSI is hiring an Application Security Engineer based in Palo Alto, CA (onsite). This role spans code security, CI/CD hardening, threat modeling, software supply chain protections, and AI-focused security practices aligned to OWASP LLM Top 10.

Compensation: $100,000 - $258,000 USD annually. Base salary is part of a broader total rewards package that includes equity, comprehensive medical, vision, and dental coverage, 401(k), short & long-term disability insurance, life insurance, and various other discounts and perks.

Responsibilities

• Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in applications
• Design and implement secure coding guidelines and best practices for development teams
• Collaborate with development teams to integrate security practices throughout the CI/CD pipeline using DevSecOps approaches
• Perform threat modeling and risk assessments, and develop mitigation strategies
• Manage vulnerability tracking and remediation efforts, providing guidance to development teams
• Support incident response activities related to application security
• Stay current on emerging threats and trends in cloud-native technologies and AI, continuously improving security measures
• Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs)
• Address security concerns for AI and machine learning models, with a focus on OWASP LLM Top 10

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, or a related field
• 3-5 years of experience in application security, with a strong focus on code security practices
• Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (including OWASP Top 10)
• Proficiency in Python or Rust, with experience applying secure coding practices in these languages
• Experience securing CI/CD pipelines and implementing DevSecOps practices
• Familiarity with software supply chain security and SBOM generation tools
• Experience using security testing tools (e.g., Burp Suite, OWASP ZAP) and performing static and dynamic code analysis
• Understanding of AI/ML security implications, particularly those outlined in OWASP LLM Top 10
• Excellent communication skills, including the ability to explain complex security issues to both technical and non-technical audiences

Preferred Skills and Experience

• Experience with cloud platforms (e.g., GCP, AWS, Azure) and their security features
• Relevant security certifications (e.g., CSSLP, OSWE)
• Background in data privacy and compliance regulations relevant to cloud-native applications and AI systems
• Experience with GitOps and infrastructure-as-code security
• Familiarity with federated learning and privacy-preserving machine learning techniques
• Experience building custom security tooling to enhance and automate security processes
• Interest in leveraging AI to automate security tasks and improve efficiency
• Contributions to open-source security projects or tools
• Experience securing AI/ML models and data pipelines

Technologies

• Python, Rust, Burp Suite, OWASP ZAP, SBOM, GCP, AWS, Azure