Lead Application Security Engineer

Lead Application Security Engineer to advance application security capabilities through hands-on engineering, secure design, and CI/CD security automation.

Responsibilities

• Support the Head of Information Security in building out the Application Security (AppSec) function at Panthalassa
• Perform code reviews and service architecture reviews to deliver security guidance
• Lead engineers in threat modeling for applications and services
• Partner on the definition of software security metrics that are useful to engineering teams
• Assist with interviewing and onboarding additional Security personnel
• Contribute to incident response as the program grows, with escalation support as the team matures
• Integrate, maintain, and automate security tools within CI/CD pipelines, including SAST, DAST, SCA, and secrets management
• Build and integrate agentic security tools for Panthalassa needs
• Conduct hands-on threat modeling and architectural design reviews for new features and applications before implementation
• Run manual and automated secure code reviews and support targeted penetration testing for web and mobile applications
• Help manage external Vulnerability Disclosure or Bug Bounty programs and translate regulatory requirements into actionable engineering tasks

Requirements

• 6+ years of experience with Application Security processes
• 2+ years experience as a Team Lead or Manager of an Application Security team
• Broad and deep foundation in Application Security principles
• Professional experience using AI systems and agents for security outcomes
• Deep understanding of OWASP Top 10, CWE Top 25, and secure design patterns
• Hands-on experience with industry-standard security tools (examples include Snyk, GitHub Advanced Security, Burp Suite, Fortify)
• Bachelor’s degree in Computer Science, Cybersecurity, or equivalent practical experience

Technologies

• SAST, DAST, SCA
• Secrets management
• CI/CD pipelines
• AI systems, agentic security tools
• OWASP Top 10, CWE Top 25
• Snyk, GitHub Advanced Security, Burp Suite, Fortify
• Web and mobile applications

Benefits

• Cash compensation: $200,000 - $260,000 per year
• Equity in the company
• Flexible paid time off
• Health insurance: company pays 100% of gold-level PPO plan for full-time employees, partners, and dependents
• Dental insurance: company pays 100% for full-time employees, partners, and dependents
• Vision insurance: company pays 100% for full-time employees, partners, and dependents
• Disability insurance: company pays 100% for a policy to provide long-term financial support if you become disabled
• Tax-advantaged accounts including 401(k), health FSA, and dependent care FSA
• Relocation assistance to facilitate your move to Portland (if needed)

Desired Qualifications

• Experience with software development work related to mechanical engineering environments
• Familiarity with cloud platforms (AWS, Azure, or GCP)
• Experience with modern infrastructure tools such as Docker, Kubernetes, and Infrastructure as Code (IaC)

Additional Requirements

• Travel to conferences, vendors, and test sites as needed
• Intermittently able to work longer hours and weekends to support critical needs

Location

• Portland, OR (on-site)
• Offices, lab, and shop located in Portland, Oregon