Full Job Description
We're looking for an application security engineer to help run and scale our day-to-day AppSec program. You will help us on our journey to operating our scanning tools, triaging findings, and working directly with engineering teams to get vulnerabilities fixed.
What you'll do & how you'll make your mark.
• Operate and maintain AppSec scanning tools (SAST, SCA, secrets scanning, container scanning) across the SDLC
• Triage findings, validate true positives, and prioritize remediation with engineering teams
• Track vulnerabilities through to closure and monitor SLA compliance
• Support onboarding of new repositories/services into the security tooling
• Contribute to internal documentation, runbooks, and process improvements
• Assist with basic scripting/automation tasks under guidance from senior team members
Who you are & what you'll need to succeed.
• 2-4 years in application security, security engineering, or a related software/QA engineering role
• Working knowledge of common vulnerability classes (OWASP Top 10) and secure SDLC practices
• Basic scripting ability (Python preferred) for automating repetitive tasks
• Comfortable communicating findings clearly to developers
• Strong attention to detail and ability to manage a queue of findings across multiple tools
Nice to have:
• Exposure to Defect Dojo, Dependency-Track, Truffle Hog, Trivy, and/or Semgrep
• Familiarity with CI/CD pipelines and how security scans plug into them
• Interest in growing into tool integration, automation, or custom rule-writing over time
