Sr. Application Security Engineer

Sr. Application Security Engineer role in Salt Lake City, UT (hybrid), embedded with product and engineering teams to strengthen security across the software delivery lifecycle.

Responsibilities

• Lead security architecture and design reviews for new and evolving features, identifying risk early and proposing practical mitigations
• Run threat modeling and perform manual and automated code reviews, partnering with developers to prioritize and remediate findings
• Apply a risk-based approach to application security, explaining vulnerabilities in terms of business impact
• Help mature Secure SDLC with secure coding standards, security requirements, and automated checks in CI/CD pipelines, including SAST, DAST, SCA, and secrets scanning
• Build and maintain security tooling and automation that scales across teams, focused on reducing risk
• Own and grow the security champions program, training champions so security expertise is available within each team
• Serve as an application security subject matter expert for engineering, product, and leadership; mentor engineers on secure development practices
• Ensure AI tools and AI-powered features are adopted within acceptable risk limits
• Align applications with SOC 1, SOX, CIS v8, and PCI DSS (including SAQ-A and SAQ-P2PE); support audits with evidence and remediation plans

Requirements

• 6+ years combined experience in software engineering, application security, product security, or a closely related field
• Proficiency in primary languages: C# .NET, TypeScript, JavaScript, SQL
• Experience securing web applications using modern frameworks and cloud-native architectures, with emphasis on AWS
• Hands-on white-box testing and secure code review experience
• Strong understanding of SSDLC principles, including implementing or maturing secure development programs
• Working knowledge of common vulnerabilities and attack techniques, including OWASP Top 10, API security, and authentication/authorization flaws
• Experience integrating security tooling into delivery pipelines using GitHub, TeamCity, or similar
• Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows
• Risk-focused mindset: translate security risk into business terms, weigh against risk tolerance and needs, and support pragmatic decisions without security theater
• Demonstrated ability to build trusted relationships with engineering teams and influence behavior without direct authority
• Strong written and verbal communication, comfortable in both design reviews and leadership risk discussions

Technologies

• AWS, Vercel, C# .NET, TypeScript, JavaScript, React/Next.js, SQL Server, SQL
• SAST, DAST, SCA, secrets scanning, CI/CD, GitHub, TeamCity
• SOC 1, SOX, CIS v8, PCI DSS, SAQ-A, SAQ-P2PE
• OWASP Top 10, API security, SSDLC
• Agentic systems, MCP, LLM-powered workflows
• Secure coding standards

Preferred Qualifications

• Development experience with Next.js, Vercel, or serverless architectures
• Practical knowledge of security frameworks and standards such as OWASP ASVS, NIST 800-53, CIS v8, PCI DSS, or SOX
• Hands-on security certifications such as OSCP, BSCP, GWEB, PNPT, or similar
• Experience running or triaging a bug bounty program
• Bachelor’s degree in Computer Science, Information Security, or a related field

Work Environment & Physical Requirements

• Sedentary work in an office environment; limited lifting (less than 10 pounds) or walking required
• Close visual acuity required to perform work at a computer terminal
• No exposure to adverse environmental conditions
• Requires repetitive typing motion, talking, hearing, grasping, and feeling

Applications deadline: Applications will be accepted until the position is filled.