Application Security Engineer

VGS; United States; Hybrid; CAD 250,000 - 328,000; Full time

Benefits offered by this job

Remote opportunities

Flexible working hours

Office lunches

Internet stipend

Learning stipend

Early equity

Job summary

VGS is hiring an Application Security Engineer to partner across Security and Engineering, shaping a developer-friendly Secure SDLC and embedding security into CI/CD.

You will automate security controls, manage a private bug bounty, and grow a Security Champions network across a globally distributed team, while conducting threat modeling for Java and Python microservices.

Join a remote-first company with flexible work arrangements and a strong focus on security for payments at scale.

Qualifications

• 3–5+ years in Application Security and/or full stack development.
• Experience conducting secure code assessments for Java and Python apps.
• Skilled at integrating SAST/DAST tools into CI/CD pipelines.
• Experience running bug bounty programs and defining metrics.
• Experience with STRIDE threat modeling.

Responsibilities

• Automate Security Controls: Integrate proactive security tooling into CI/CD pipelines.
• Define & Drive Secure SDLC: Design, communicate, and maintain developer-friendly SDLC processes and threat modeling.
• Manage Bug Bounty & Triage: Lead private bug bounty program and triage reports.
• Build Engineering Capability: Provide secure coding training and foster a Security Champions network.
• Lead AppSec Reviews: Conduct threat models and code reviews for Java and Python microservices.
• Amplify Security Culture: Collaborate on technical blogs and vulnerability disclosures.

Skills

AppSec experience

Technical depth

Tooling & automation

Vulnerability & program mgmt

Threat modeling

Collaborative mindset

Education

BA/BS degree

Tools

GitHub Advanced Security

ZAP/BURP

Synopsys/Veracode

Semgrep

Job description

About VGS

VGS is building the trust infrastructure for a new era of commerce. As commerce becomes agentic, payments are increasing dramatically in volume, speed, and complexity, and the companies driving that shift need a foundation they can fully trust.

That’s where VGS comes in. We’re the world’s leader in payment tokenization, trusted by the most innovative AI and Fortune 500 companies, merchants, banks, and fintechs to power modern payments and agentic commerce. We store more than 9 billion tokens and process more than 10 billion monthly interactions, touching a third of all e-commerce. That scale isn’t incidental. It’s why leading companies embed our universal token vault and credential management platform directly into their stack, taming the complexity of payment data so they can move faster.

Come build the platform that enables modern payments for the world’s largest companies. We’re helping businesses unlock new possibilities in an industry that never stops moving. And that takes exceptional people.

About the Role

As an Application Security Engineer, you will partner directly across Security and Engineering to build a friction-free, developer-centric security program. You will shape our Secure SDLC, automate security guardrails in our CI/CD pipelines, scale our private bug bounty program, and foster a strong culture of security champions across a globally distributed team.

• Automate Security Controls: Integrate proactive security tooling (SAST, DAST, SCA) directly into CI/CD pipelines (GitHub/GitLab) to catch vulnerabilities before code hits production.

• Define & Drive Secure SDLC: Design, communicate, and maintain developer-friendly SDLC processes, frameworks, and threat modeling practices (e.g., STRIDE).

• Manage Bug Bounty & Triage: Spearhead our private bug bounty program—tracking spends, triaging reports, and lowering Mean Time to Mitigation (MTTM).

• Build Engineering Capability: Share best practices through secure coding training and cultivate a Security Champions network across Engineering.

• Lead AppSec Reviews: Conduct threat models and code reviews for Java and Python microservices.

• Amplify Security Culture: Partner with external communications to author technical blogs, manage vulnerability disclosures, and showcase VGS’s security engineering.

What You Bring

• AppSec Experience: 3–5+ years of dedicated experience in Application Security and/or full stack development, with proven experience .

• Technical Depth: Practical background conducting secure code assessments for Java and Python applications.

• Tooling & Automation: Deep familiarity integrating SAST/DAST tools (e.g., GitHub Advanced Security, ZAP/BURP, Synopsys/Veracode, Semgrep and similar tools) into modern CI/CD systems.

• Vulnerability & Program Management: Hands‑on experience operating bug bounty programs and setting program metrics/KPIs.

• Threat Modeling: Practical experience applying frameworks like STRIDE to complex systems.

• Collaborative Mindset: Exceptional communication skills with a track record of building trust across engineering teams.

Nice to Have

• BA/BS degree

• A knack for out‑of‑the‑box thinking that thrives in a fast‑paced startup environment

• Prior experience in cloud‑native, high‑growth, or pre‑IPO fintech startups.

• Hands‑on experience with AWS security controls and cloud infrastructure.

• Comfortable navigating fully remote, globally distributed work environments.’

We’re looking for passionate professionals who take pride in their craft and want to help grow a team tackling some of the most critical problems in payments. People who thrive here are curious by nature, unafraid of hard problems, and motivated by the chance to build something that matters at scale.

If you’re driven to make a meaningful impact, work at the leading edge of payment technology, and grow your career alongside a team that values ownership, collaboration, and continuous learning, you’ll feel right at home at VGS.

$175,000 - $230,000 a year

How We Work

At VGS, we embrace a remote‑first philosophy because we believe flexibility leads to great work and a healthy work‑life balance. That said, if you live within 30 miles of one of our office locations, you’ll be on a hybrid schedule with some in‑person time, because we know there’s real value in coming together.

We’re not about being in the office every day. We are about connection, collaboration, and the energy that comes from a great brainstorm, a team lunch, or celebrating a big win in person.

Our Benefits

Financial and retirement

• Competitive salary

• 401(k) with a 4% match and immediate vesting (applies to US only)

• Early equity

• Internet stipend

• Learning stipend

• Office set‑up stipend (applies to US only)

Health and Wellness

• Insurance (medical, dental, and vision)

• HSA/FSA options

• Life and disability insurance

• Pet insurance

Vacation and time off

• Flexible PTO

• Paid national holidays

• Global parental leave program

Professional Development

• Promote from within

• Lunch and learns

• Team events and summits

Office life and perks

• Remote and hybrid opportunities

• Flexible working hours

• Weekly office lunches

• Employee discount platform

Equal Opportunity

We consider all applicants without regard to race, color, national origin, sex, age, religion, sexual orientation, gender identity, veteran status, marital status, physical or mental disability, or other protected classes under all applicable local, state, and federal laws and ordinances (AA/EOE/W/M/Vet/Disabled).

Qualified applicants with arrest and conviction records will be considered for this position in accordance with the San Francisco Fair Chance Ordinance.

Where We’re Hiring

We are currently hiring in the following locations: Arizona, California, Colorado, Connecticut, Florida, Idaho, Illinois, Iowa, Michigan, Minnesota, New York, North Carolina, Ohio, Oregon, Pennsylvania, Texas, Utah, Virginia, Washington, Ontario (Canada), Alberta (Canada), and British Columbia (Canada).