W2 - 10+ Application Security Engineer - (Bay Area/NYC/REMOTE)

Position Details

Role: Senior Application Security Engineer

Location: Our staffing locations, in order of preference, are:

• Bay Area
• NYC
• USA (Remote)

General position overview

We are seeking a seasoned Application Security & Vulnerability Validation Engineer (5+ years of experience) to serve as the operational and technical bridge between automated/AI-driven security scanning and remediation systems and product engineering teams.

In this role, you will streamline service threat modeling, eliminate scanner triage noise, build minimal proofs-of-concept (PoCs) to validate exploitability, perform rigorous quality assurance on AI/agent-generated security patches, and partner with software engineers to drive confirmed vulnerabilities to verified production closure.

1. Vulnerability Reproduction & PoC Validation

• Construct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findings.
• Distinguish true, exploitable vulnerabilities from scanner false positives and attach clear, reproducible evidence to issue tickets.

2. Automated / Agentic Patch Oversight & QA

• Supervise, review, and validate code patches generated by automated and AI/agentic remediation systems before they are routed to product code owners.
• Inspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and unintended functional regressions.
• Execute unit, integration, and differential tests to confirm both fix efficacy and build stability (targeting a 90% patch acceptance rate by code owners without major revision).

3. Vulnerability Triage & Policy Evaluation

• Review, filter, and prioritize incoming findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24–48 hour turnaround window.
• Classify vulnerability severity using standardized scoring rubrics and map valid findings to strict remediation SLAs.
• Evaluate standard compliance exception requests against established security policies and escalate ambiguous, disputed, or architectural edge cases to senior security leads.

4. Threat Modeling & Asset Profiling

• Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services.
• Maintain standardized threat models and service risk classification tags in centralized repositories.

5. Engineering Coordination & Remediation Closure

• Route verified, test-passing security patches (changelists / pull requests) to designated product engineering owners.
• Shepherd fixes through code review, track remediation SLAs, and verify end-to-end deployment to production.

Minimum Qualifications (Must-Haves)

• Experience: 5+ years of hands-on experience in Application Security, Product Security, or Software Engineering with a strong focus on vulnerability validation, secure code review, and test automation.
• Programming & Test Harness Development: Proficiency in reading, writing, and debugging code in at least two core languages (C++, Go, Java, or Python), with the ability to set up local test harnesses, mock dependencies, and build minimal PoCs.
• Secure Code Review: Deep understanding of secure coding standards (input validation, boundary checking, safe memory access, concurrency safety) and high attention to detail when reviewing code diffs for regressions, hallucinations, or off-by-one errors.
• Vulnerability & Policy Fundamentals: Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflows.
• Threat Modeling: Understanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks (e.g., STRIDE, PASTA).
• Engineering Communication: Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate constructively with software engineering owners through code review.

Preferred Qualifications (Nice-to-Haves)

• AI / Automated Remediation QA: Experience validating, debugging, or prompt-tuning automated code generation tools, along with automated patch validation and differential testing.
• Advanced Dynamic Testing: Practical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across service