What we're looking for:We are seeking a technically hands-on Application Security Engineer to join the Information Security team. This individual will own the vulnerability management lifecycle across our SAST, DAST, and SCA tooling, integrate security automation into the CI/CD pipeline, perform threat modeling of product and engineering designs, and serve as a trusted advisor to our 300+ person engineering organization. The ideal candidate is a builder who would rather automate a finding than file a ticket, and who can explain a critical vulnerability to a junior developer without making them feel two inches tall.
Arcadia is headquartered in Washington, DC, and open to fully remote candidates.
What you'll do:- Own the end-to-end vulnerability management lifecycle: triage, prioritize, and drive remediation of findings from SAST, DAST, and SCA tooling in partnership with engineering squads.
- Maintain, optimize, and extend security tooling integrations within the CI/CD pipeline with the goal of automating everything that can be automated.
- Launch and run a Security Champions program, including workshops and office hours, to embed security knowledge directly into development teams across multiple geographies.
- Act as the application-layer subject matter expert during security incidents, supporting triage, root cause analysis, and remediation.
- Partner with Product and Engineering leadership to introduce security touchpoints earlier in the SDLC, including threat modeling and design review processes.
What will help you succeed:Must-haves:- 3-5 years of dedicated Application Security experience in a SaaS or cloud-native environment.
- Hands-on proficiency with at least two of the following: SAST, DAST, SCA, or CSPM tooling (e.g., Snyk, Checkmarx, Semgrep, Wiz).
- Strong working knowledge of CI/CD pipelines (e.g., GitHub Actions, Jenkins, GitLab CI) and the ability to write and maintain pipeline integrations.
- Experience with container security (Docker, Kubernetes) and API security patterns (REST, GraphQL).
- Demonstrated ability to communicate technical risk to non-security engineers in a way that drives action, not anxiety.
Nice-to-haves:- Experience standing up or maturing a Security Champions program.
- Familiarity with cloud-native AWS security services (GuardDuty, Security Hub, IAM Access Analyzer).
- Exposure to threat modeling frameworks (STRIDE, PASTA, or lightweight equivalents).
- Relevant certifications (OSCP, GWAPT, CSSLP) - valued but not required.
Arcadia is the global utility data and energy solutions platform. With our leading data platform, AI-powered analytics, industry expertise, and expansive partner network, we deliver solutions for every stage of the enterprise energy management lifecycle across carbon, cost, and reliability.
Benefits:- "Remote first" culture - work anywhere in the US as long as you have a reliable internet connection
- Flexible PTO - no accrued hours and no limit on the number of vacation days exempt employees can take each year
- 12 annual holidays
- 10 days sick leave
- Up to 4 weeks bereavement leave
- 2 volunteer days off
- 2 professional development days off
- 12 weeks paid parental leave for all parents
- 75-95% employer cost coverage for medical, dental, and vision benefits for employees and dependents
