Application Security Engineer Remote (Remote, US) · Remote

Arcadia Power, Inc.; Washington, Northern (District of Columbia, KY); Hybrid; USD 131,000 - 235,000; Full time

Benefits offered by this job

Remote-first culture

Flexible PTO

11 holidays

10 sick days

Bereavement leave

2 PD days

Parental Leave

Premium benefits

Job summary

Arcadia Power, Inc. is seeking a hands-on Application Security Engineer to own the vulnerability management lifecycle across SAST, DAST, and SCA tooling, and to automate security tasks in the CI/CD pipeline.

You will drive threat modeling with product and engineering, serve as the security SME during incidents, and help embed security across teams in a remote-first, US-wide environment. A SaaS security background and strong communication skills are highly valued.

Qualifications

• 3–5 years of dedicated Application Security experience in SaaS or cloud-native environments.
• Hands-on with two or more of SAST, DAST, SCA, or CSPM tooling.
• Strong knowledge of CI/CD pipelines and ability to wire integrations.
• Experience securing containers (Docker, Kubernetes) and API security patterns.

Responsibilities

• Own end-to-end vulnerability management lifecycle across SAST, DAST, and SCA tooling.
• Automate security tooling integrations within the CI/CD pipeline to reduce manual work.
• Launch and run a Security Champions program across geographies.
• Act as application-layer security SME during incidents, supporting triage and root cause analysis.
• Collaborate with Product and Engineering leadership to embed security earlier in SDLC.

Skills

SAST

DAST

SCA

CSPM tooling

CI/CD pipelines

Docker

Kubernetes

API security (REST/GraphQL)

Security risk communication

Threat modeling

Tools

GitHub Actions

Jenkins

GitLab CI

Snyk

Checkmarx

Semgrep

Wiz

Cloud security tooling

Job description

Arcadia is the AI-powered energy intelligence platform for businesses. We replace fragmented tools and manual workflows with one platform to pay utility bills, buy energy, and advance sustainability — across every location, at enterprise scale.

Trusted by Fortune 2000 companies, Arcadia combines unified data, AI-powered analytics, and expert advisory to help enterprise teams save money, mitigate risk, and cut carbon .

We deliver this through three comprehensive solutions:

• Utility Bill Management: Automating the entire utility bill lifecycle — from data capture and validation to payment processing and auditing.
• Energy Procurement Advisory : Bringing together comprehensive data, AI-powered analytics, market expertise, and a strong partner network to make sophisticated procurement options accessible to all. .
• Sustainability Reporting — Verified emissions data with seamless integration into leading sustainability platforms.

Tackling the world's most complex energy challenges requires diverse thinking. We're building teams of people from different backgrounds, industries, and disciplines — united by a belief that energy management should be simple, intelligent, and a genuine driver of business value.

What we’re looking for:

We are seeking a technically hands-on Application Security Engineer to join the Information Security team. This individual will own the vulnerability management lifecycle across our SAST, DAST, and SCA tooling, integrate security automation into the CI/CD pipeline, perform threat modeling of product and engineering designs, and serve as a trusted advisor to our 300+ person engineering organization. The ideal candidate is a builder who would rather automate a finding than file a ticket, and who can explain a critical vulnerability to a junior developer without making them feel two inches tall.

Arcadia is headquartered in Washington, DC, and open to fully remote candidates.

Arcadia is open to fully remote candidates and employees have access to co-working spaces.

• "Remote first" culture - work anywhere in the continental US as long as you have a reliable internet connection
• Flexible PTO - no accrued hours and no limit on the number of vacation days exempt employees can take each year
• 11 annual holidays
• 10 days sick leave
• Up to 2 weeks bereavement leave
• 2 professional development days off
• Parental Leave Benefits for ALL parents
• 75-95% employer cost coverage for medical, dental, and vision benefits for employees and dependents

Here at Arcadia, we cultivate diversity, celebrate individuality, and believe unique perspectives are key to our collective success in creating a clean energy future. Arcadia is committed to equal employment opportunities regardless of race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, disability, genetic information, protected veteran status, or any status protected by applicable federal, state, or local law.

We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation by emailing [e-mail] prior to completing your application.

Target Annual Compensation Range for this role will be $131,250 to $235,136 There will also be a competitive benefits and equity (bonus if applicable) component to the package. The exact compensation at which this job is filled will be determined by the skills, experience, and location of the qualified candidate. Please note that we are unable to offer visa sponsorship for this position at this time.

Automated Screening:

Arcadia uses AI-assisted technology to evaluate candidates on relevant skills, experience, and education as outlined in the job description. Human review is part of all hiring decisions. Candidates may request an alternative selection process by contacting [e-mail] before submitting your application.

Data Privacy & California Residents:

You voluntarily provide personal information (such as your resume, contact details, and assessment responses) when submitting an application. We may use this to evaluate your candidacy and derive inferences from this data to match your profile with open roles. For California Residents: This collection is consistent with the CCPA. You have the right to request access to or deletion of your data by contacting [e-mail].

• Select R&D & Data roles: We are proud to offer visa sponsorship opportunities for qualified candidates interested in joining our team
• Other roles: Please note that we are unable to offer visa sponsorship for this position at this time

What you’ll do:

• Own the end-to-end vulnerability management lifecycle: triage, prioritize, and drive remediation of findings from SAST, DAST, and SCA tooling in partnership with engineering squads.
• Maintain, optimize, and extend security tooling integrations within the CI/CD pipeline with the goal of automating everything that can be automated.
• Launch and run a Security Champions program, including workshops and office hours, to embed security knowledge directly into development teams across multiple geographies.
• Act as the application-layer subject matter expert during security incidents, supporting triage, root cause analysis, and remediation.
• Partner with Product and Engineering leadership to introduce security touchpoints earlier in the SDLC, including threat modeling and design review processes.

What will help you succeed:

Must-haves:

• 3–5 years of dedicated Application Security experience in a SaaS or cloud-native environment.
• Hands-on proficiency with at least two of the following: SAST, DAST, SCA, or CSPM tooling (e.g., Snyk, Checkmarx, Semgrep, Wiz).
• Strong working knowledge of CI/CD pipelines (e.g., GitHub Actions, Jenkins, GitLab CI) and the ability to write and maintain pipeline integrations.
• Experience with container security (Docker, Kubernetes) and API security patterns (REST, GraphQL).
• Demonstrated ability to communicate technical risk to non-security engineers in a way that drives action, not anxiety.

Nice-to-haves

• Experience standing up or maturing a Security Champions program.
• Familiarity with cloud-native AWS security services (GuardDuty, Security Hub, IAM Access Analyzer).
• Exposure to threat modeling frameworks (STRIDE, PASTA, or lightweight equivalents).
• Relevant certifications (OSCP, GWAPT, CSSLP) — valued but not required.