Application Security Engineer

Cybersecurity Jobs; Washington (District of Columbia); On-site; USD 100,000 - 258,000; Full time

Benefits offered by this job

Equity

Medical/Vision/Dental coverage

401(k)

Short & Long-term disability insurance

Life insurance

Job summary

SpaceXSI is seeking an Application Security Engineer to protect payments and financial products throughout the software lifecycle. This on-site role in Washington, DC focuses on code security, CI/CD pipeline security, threat modeling, and vulnerability management with SBOMs and LLM-based tooling.

You will design secure coding guidelines, embed security in CI/CD, conduct threat modeling, and oversee vulnerability remediation and the bug bounty program.

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, or related field.
• 3–5 years of experience in application security.
• Experience in payments, money transmission, wallets, or related financial platforms.
• Deep understanding of secure coding practices and OWASP Top 10.
• Proficiency in Python or Rust with secure coding practices.
• Experience securing CI/CD pipelines and DevSecOps.
• Familiarity with SBOM generation tools and software supply chain security.
• Experience with Burp Suite and OWASP ZAP for testing.
• Experience securing payments and high-value transaction systems.
• Experience designing agentic and LLM-based security solutions.
• Excellent communication skills.

Responsibilities

• Perform in-depth code reviews and static analysis to identify security vulnerabilities in financial applications
• Design and implement secure coding guidelines and best practices for development teams
• Embed security practices into the CI/CD pipeline
• Conduct threat modeling and risk assessments for payments and related surfaces
• Oversee vulnerability tracking and remediation guidance
• Manage the bug bounty program, including intake, triage, researcher communication, and disclosure
• Support application security incident response activities
• Monitor emerging threats and improve controls
• Evaluate and secure software supply chains, producing SBOMs
• Design and implement agentic and LLM-based solutions to detect/investigate security problems

Skills

Python

Rust

DevSecOps

SBOM tools

Burp Suite

OWASP ZAP

Payments security

Agentic & LLM solutions

Communication

Education

Bachelor’s degree in Computer Science or Cybersecurity

Tools

SBOM generation tools

AWS

Job description

SpaceXSI is seeking an Application Security Engineer focused on protecting the security and integrity of payments and financial products throughout the software development lifecycle. In this onsite Washington, DC role, you will help strengthen controls for code security, CI/CD pipeline security, threat modeling, and vulnerability management, with support from security tooling such as SBOMs and agentic or LLM-based solutions.

What you’ll do

• Perform in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications
• Design and implement secure coding guidelines and best practices for development teams
• Work with development teams to embed security practices into the CI/CD pipeline
• Conduct threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, including mitigations for fraud, abuse, and unauthorized movement of funds or credits
• Oversee vulnerability tracking and remediation, providing guidance to development teams
• Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure
• Support application security incident response activities
• Monitor emerging threats targeting financial and cloud-native systems and continuously improve controls
• Evaluate and secure software supply chains, producing and maintaining Software Bills of Materials (SBOMs)
• Design and implement agentic and LLM-based solutions to help detect, investigate, or prevent security problems

Required qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, or a related field
• 3-5 years of experience in application security, with a strong focus on code security practices
• Experience in payments, money transmission, digital wallets, or related financial platforms
• Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (including OWASP Top 10)
• Proficiency in Python or Rust with secure coding practices in these languages
• Experience securing CI/CD pipelines and implementing DevSecOps practices
• Familiarity with software supply chain security and SBOM generation tools
• Experience with security testing tools such as Burp Suite and OWASP ZAP, plus static and dynamic code analysis
• Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues
• Experience designing and implementing agentic and LLM-based solutions for security problems
• Excellent communication skills to explain complex security issues to technical and non-technical audiences

Technologies

• Python, Rust
• OWASP Top 10
• Burp Suite, OWASP ZAP
• SBOMs, SBOM generation tools
• DevSecOps
• Agentic solutions, LLM-based solutions
• CI/CD pipelines

Compensation and benefits

USD 100,000 - 258,000 per yearly salary range. Base salary is part of a total rewards package that includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k), short & long-term disability insurance, life insurance, and various other discounts and perks.

Preferred skills and experience

• Hands-on experience securing applications on AWS (other cloud platforms are a plus)
• Relevant security certifications (e.g., BSCP, OSCP, OSWE)
• Experience managing bug bounty programs
• Background in data privacy and compliance relevant to financial products and cloud-native applications
• Experience with GitOps and infrastructure-as-code security
• Experience building custom security tooling to enhance and automate security processes
• Contributions to open-source security projects or tools

ITAR requirements

To conform to U.S. Government export regulations, applicants must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here.