Lead Application Security Engineer

Join Tiro Security as a hands-on Lead Application Security Engineer in Pasadena, CA (onsite). This role strengthens DevSecOps and software assurance for an established financial services organization, with a focus on securing development pipelines and evaluating the trustworthiness of both internal and third-party applications. The compensation range is $120,000–$180,000 base per year.

What you’ll do

• Secure development pipelines by assessing the trustworthiness of internally developed and third-party applications.
• Coordinate penetration testing and support security outcomes with API security assessments.
• Use threat intelligence to inform software risk decisions.

How you’ll deliver impact

Work closely with engineering teams to influence how software is developed, assessed, and approved for enterprise use. The scope combines pipeline security with deeper application analysis and continuous validation of application trust, including ongoing evaluation of risk based on technical findings.

Requirements

• Proven application security or DevSecOps experience, including secure SDLC, threat modeling, and vulnerability remediation.
• Hands-on experience with GitHub Advanced Security, including secret scanning, push protection, and security automation within CI/CD pipelines.
• Practical SAST, DAST, and code-review experience, with tools such as CodeQL, Dependabot, and OWASP ZAP.
• Experience assessing third-party software, dependencies, or compiled binaries, including knowledge of software supply chain security.

Technical focus areas

• GitHub Advanced Security, secret scanning, push protection
• CI/CD pipelines, SAST, DAST
• CodeQL, Dependabot, OWASP ZAP
• Threat intelligence and API security

Work authorization

• US work authorization is required.
• Visa sponsorship is unavailable.

Job reference: 6145