Senior Security Engineer - Application SecurityLocation: United States - Remote | Department: Security | Reports to: Chief Information Security Officer
Role overviewNasuni is seeking a Senior Security Engineer specializing in application security and penetration testing to protect our growing portfolio of enterprise data infrastructure and SaaS products. You will identify and validate vulnerabilities, conduct penetration tests, guide secure design decisions, and work with Engineering to remediate and retest findings across Nasuni products, Resilio, DryvIQ, cloud services and emerging AI-enabled capabilities.
Scope and impactYou will independently execute complex security assessments, coordinate assigned testing initiatives, and recommend risk-based priorities within established security standards. This hands-on role combines technical judgment, practical automation, and cross-functional influence.
Responsibilities- Conduct threat modeling, secure design and targeted code reviews for web applications, APIs, cloud services and appliances.
- Perform manual and tool-assisted penetration testing; document reproducible findings and verify fixes.
- Coordinate external penetration-test scoping, execution, report quality review, remediation tracking and retesting.
- Validate customer-reported vulnerabilities and advise Engineering on prioritization, mitigation and closure.
- Improve SAST, SCA, secrets detection, container scanning and CI/CD security workflows with engineering partners.
- Support SBOM and software supply-chain vulnerability impact analysis.
- Assess AI-enabled product features for access-control weaknesses, prompt injection and unintended data exposure.
- Use approved AI-assisted tools for test planning, code analysis and research; independently verify outputs and protect confidential data.
- Share practical security guidance and improve repeatable assessment processes.
Must-have qualifications- Approximately 5+ years of relevant security engineering experience with substantial hands-on AppSec or penetration testing.
- Demonstrated manual testing of web applications and APIs, including authentication and authorization issues.
- Experience with threat modeling, secure code review, vulnerability validation and remediation retesting.
- Experience coordinating third-party penetration tests and reviewing technical findings.
- Practical knowledge of OWASP guidance, security testing tools and application security controls in the SDLC.
- Ability to read code and automate tasks using a relevant programming or scripting language.
- Working knowledge of cloud services, Linux, containers or Kubernetes; effective technical communication.
Preferred qualifications- Enterprise SaaS, hybrid-cloud or appliance security experience.
- SBOM, CycloneDX/SPDX, supply-chain security and CI/CD tooling experience.
- LLM or agentic feature testing, M&A assessments, or audit evidence preparation.
- OSCP, GWAPT, GPEN, GWEB, CSSLP or equivalent demonstrated skills.
Ideal differentiatorsIndependently discovered complex flaws and verified remediation; improved repeatable security workflows; balanced risk across SaaS and hybrid infrastructure; responsibly applied AI-assisted analysis with demonstrable validation.
Experience guidelinesFive or more years of relevant experience is typical, with meaningful direct responsibility for application security assessments. Equivalent demonstrated expertise is valued. A related degree or equivalent practical experience is welcome.
Success measures90 days: establish findings, testing environment and remediation visibility. Six months: deliver risk-based internal testing and improve threat-modeling consistency. Twelve months: coordinate the annual external assessment and show measurable remediation progress.
