Staff/Lead Application Security Engineer

Beacon Holdings is hiring its first dedicated application security engineer to set product security strategy and build an application security program across Beacon and its portfolio companies. The role spans secure design and architecture, acquisition security reviews, vulnerability management, AI security, and the tooling and enablement needed to make security sustainable as the organization grows.

This is a full remit position where you will work alongside engineering teams at Beacon HQ and within portfolio companies. You will embed in product and platform planning, lead technical standards, and serve as the application security expert during incidents from investigation through remediation and postmortem.

What you will do

• Lead threat modeling and security architecture reviews for new product work and platform initiatives, and define standards for authentication, authorization, encryption, and tenant isolation.
• Own product security reviews for newly acquired codebases and cloud environments, establishing a baseline posture, identifying material risk, and defining the remediation path.
• Perform secure code review, with a focus on authorization and business logic flaws that automated tooling does not catch.
• Identify and manage the external partner responsible for penetration testing against products and infrastructure, and drive remediation of findings.
• Assess AI features across Beacon products, including agent architectures, model and tool access, delegated credentials, and the data reachable through those capabilities.
• Own the end-to-end application security program: intake, severity and prioritization, remediation SLAs, and reporting, while driving fixes through engineering teams so they can sustain outcomes.
• Own standards for SAST, DAST, SCA, and secrets scanning, including integration into CI/CD across the portfolio.
• Build automation that enables one person to cover a multi-team portfolio, including routine fix PRs, dependency remediation, and findings routing.
• Own the security of internal tools you build, including their access to credentials, source code, and production systems.
• Write secure coding standards and training that engineering teams consult before building.
• Serve as the product security expert during incidents, supporting investigation, remediation, and postmortem activities.
• Work with GRC to produce evidence for audit and customer security reviews, ensuring compliance needs do not drive the security roadmap.
• Set the strategy for product security and begin building the program from the ground up.

Core requirements

• Prefers building systems that find bugs at scale rather than fixing one at a time.
• Already uses AI in day-to-day work, with informed judgment about where it helps, where it does not, and when to build tooling versus buy it.
• Can set architecture and security standards across many codebases, not just provide one-off reviews.
• Ships production code and can author fixes, not only specify them.
• Expert knowledge of web and API security, identity and access design (authentication, authorization, RBAC/ABAC), and applied cryptography.
• Experience securing applications in cloud environments and containerized workloads.
• Track record of driving security work to completion in engineering organizations beyond your reporting line.

Technologies

• SAST, DAST, SCA, secrets scanning, CI/CD, RBAC, ABAC

How Beacon approaches values and AI

• Humility: Strong beliefs held weakly, with active learning from others.
• Honesty: Truth-seeking approach and relationship-driven trust.
• Hunger: High standards, responsibility, and pride in ownership.
• Horizon: Building a generational software company through long-term compounding.

Beacon uses Artificial Intelligence and AI-enabled tools to assist with screening, reviewing, organizing, and highlighting profiles and applications that match key requirements. AI does not make hiring decisions; every application is reviewed by a member of the team, and decisions are made by humans.

Location: San Francisco, CA (onsite)