SpaceXSI is seeking an Application Security Engineer in Austin, TX to help safeguard the security and integrity of payments and financial products across the software development lifecycle. In this role, you will strengthen controls from code-level security through CI/CD pipeline protections, and you will apply threat modeling and vulnerability remediation to reduce risk across payment and wallet-related surfaces. You will also help design LLM and agentic approaches to detect, investigate, or prevent security problems.
What you’ll do
- Perform in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications
- Design and implement secure coding guidelines and best practices for development teams
- Partner with development teams to integrate security practices throughout the CI/CD pipeline
- Lead threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, and develop mitigations for fraud, abuse, and unauthorized movement of funds or credits
- Manage vulnerability tracking and remediation, including guidance for development teams
- Run the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure
- Support application security incident response activities
- Monitor emerging threats targeting financial and cloud-native systems and continuously enhance security controls
- Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs)
- Design and implement agentic and LLM-based solutions to help detect, investigate, or prevent security issues
Requirements
- Bachelor’s degree in Computer Science, Cybersecurity, or a related field
- 3-5 years of experience in application security, with a strong focus on code security practices
- Experience in payments, money transmission, digital wallets, or related financial platforms
- Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities, including OWASP Top 10
- Proficiency in Python or Rust and experience applying secure coding practices in these languages
- Experience securing CI/CD pipelines and implementing DevSecOps practices
- Familiarity with software supply chain security and SBOM generation tools
- Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis
- Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues
- Experience designing and implementing agentic and LLM-based solutions for security problems
- Excellent communication skills, able to explain complex security issues to technical and non-technical audiences
Technologies
- Python, Rust
- CI/CD pipelines, DevSecOps
- OWASP Top 10
- Burp Suite, OWASP ZAP
- Software Bills of Materials (SBOMs)
- LLM-based solutions, agentic solutions
- AWS
Preferred skills and experience
- Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus
- Relevant security certifications (e.g., BSCP, OSCP, OSWE)
- Experience managing bug bounty programs
- Background in data privacy and compliance relevant to financial products and cloud-native applications
- Experience with GitOps and infrastructure-as-code security
- Experience building custom security tooling to enhance and automate security processes
- Contributions to open-source security projects or tools
Compensation and benefits
$100,000 - $258,000 USD per year. Benefits include equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short and long-term disability insurance, life insurance, and various other discounts and perks.
ITAR requirements
To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.
