Application Security Engineer

Reuben Cooley Inc.; New York (NY); Hybrid; USD 170,000 - 230,000; Full time

Job summary

Reuben Cooley Inc. seeks a Senior Application Security Engineer to join our hybrid team in Princeton, NJ and NYC, NY. You will ship secure software, drive secure SDLC, perform threat modeling, and own API security and authn/authz.

You will automate security workflows with Python, leverage Claude Code for tooling, and shape protections for AI/LLM-enabled systems. Ideal candidates have 8–15+ years of hands-on engineering and a track record securing complex apps.

Qualifications

• 8-15+ years of software engineering and application security with hands-on development experience.
• Strong Python for automation and tooling.
• Proficiency with Claude Code—daily use and extension for reusable security workflows.
• Working understanding of AI agents and agentic frameworks, and security concerns around them (OWASP LLM Top 10, agent tool permissions, prompt injection, supply-chain risk).
• Depth in secure SDLC, threat modeling, and common vulnerability classes (OWASP Top 10, API security, authn/authz).
• The judgment to know when to automate, when to escalate, and when to fix it yourself.

Skills

Python

Claude Code

AI agents

Threat modeling

OWASP Top 10

API security

AuthN/AuthZ

Secure SDLC

Tools

Claude Code

Job description

Job Title: Senior Application Security Engineer

Location- Princeton, NJ & NYC, NY (Hybrid)

Duration- Full time Employment

Summary:

• 8-15+ years in software engineering and application security, with substantial hands‑on development experience (not security‑adjacent — you’ve shipped code).
• Strong Python for automation and tooling.
• Proficiency with Claude Code — you use it daily and know your way around its extensibility (skills, subagents, hooks, slash commands, and MCP integrations) to build reusable security workflows and automation, with a clear‑eyed view of its strengths and failure modes.
• Working understanding of AI agents and agentic frameworks, and the emerging security concerns around them (OWASP LLM Top 10, agent tool permissions, prompt injection, supply‑chain risk in model/tooling).
• Depth in secure SDLC, threat modeling, and common vulnerability classes (OWASP Top 10, API security, authn/authz).
• The judgment to know when to automate, when to escalate, and when to just fix it yourself.

Nice to have:

• Experience securing production LLM/agentic systems or building internal AI security tooling.
• Contributions to open‑source security tools.
• Relevant certifications (OSCP, GWAPT, CSSLP) — helpful, not required.