Application Security Engineer

vannevarlabs; USA; Remote; USD 160.000 - 210.000; Vollzeit

Benefits dieser Stelle

Fully remote within the United States

401(k) matching

Health, dental, and vision insurance

Unlimited paid time off

Mental health benefits

Flexible scheduling

Zusammenfassung

Vannevar Labs seeks an Application Security Engineer to weave security into a SaaS platform supporting defense and intelligence missions. You will collaborate with software, DevOps, and platform teams to integrate threat modeling, automated scanning, and rapid vulnerability response across the SDLC.

Responsibilities include standing up SAST/DAST and container security checks in CI/CD, leading threat modeling sessions, and shifting left to surface issues earlier.

Qualifikationen

• Five or more years of experience in Application or Product Security.
• Practical experience hardening web applications and automating AppSec workflows.
• Working knowledge of DevSecOps practices, container security, and patching.
• Proficiency with GitHub Actions, Python, and TypeScript/JavaScript.
• Strong written and verbal communication, with the ability to frame risk for engineering audiences.

Aufgaben

• Stand up and operate SAST, SCA, secrets-scanning, DAST, and container/IaC security checks inside CI/CD pipelines.
• Sit alongside development teams to lead threat modeling sessions, review high-impact pull requests, and reinforce secure-by-default practices.
• Champion a shift-left vulnerability detection program that surfaces and resolves issues earlier in the SDLC.
• Partner with DevOps to triage security issues that span application and infrastructure layers.
• Contribute to incident response for product issues and translate lessons learned into code, documentation, and process improvements.

Kenntnisse

GitHub Actions

Python

TypeScript/JavaScript

Tools

GitHub Actions

Python

TypeScript/JavaScript

Jobbeschreibung

Role overview

An Application Security Engineer is needed to weave security into a SaaS platform that supports defense and intelligence missions. The role collaborates with software, DevOps, and platform teams to integrate threat modeling, automated scanning, and rapid vulnerability response across the software development lifecycle. The position is central to safeguarding customer data, hitting compliance milestones, and scaling the security posture alongside organizational growth.

Responsibilities

• Stand up and operate SAST, SCA, secrets-scanning, DAST, and container/IaC security checks inside CI/CD pipelines
• Sit alongside development teams to lead threat modeling sessions, review high-impact pull requests, and reinforce secure-by-default practices
• Champion a shift-left vulnerability detection program that surfaces and resolves issues earlier in the SDLC
• Partner with DevOps to triage security issues that span application and infrastructure layers
• Contribute to incident response for product issues and translate lessons learned into code, documentation, and process improvements

Requirements

• Five or more years of experience in Application or Product Security
• Practical experience hardening web applications and automating AppSec workflows
• Working knowledge of DevSecOps practices, container security, and patching
• Proficiency with GitHub Actions, Python, and TypeScript/JavaScript
• Strong written and verbal communication, with the ability to frame risk for engineering audiences

Nice to have

• Background securing LLM-based workflows
• Familiarity with the NIST Risk Management Framework
• Prior software security experience at a U.S. defense contractor
• Active security clearance (or eligibility to obtain one) and willingness to travel onsite

Benefits and work setup

• Health, dental, and vision insurance
• Fully remote within the United States
• 401k matching
• Mental health benefits
• Flexible scheduling with a self-managed workday
• Pet and child care reimbursement during travel
• Unlimited paid time off
• Salary range of $160,000 - $210,000 plus equity and 401K match