Application Security Engineer (Source Code Review)

Invadel; United States; Remote; USD 90,000 - 130,000; Full time

Job summary

Invadel is seeking an experienced security reviewer to assess web, mobile, and backend code by combining static analysis with hands-on investigation. You will examine repository scopes, explain actionable risks to engineers, and verify that reported issues are fixed.

The role involves triaging analysis results, reviewing authentication and cryptography, tracing data flows, and documenting findings with precise evidence. This is a remote US-based position with US time-zone alignment.

Qualifications

• Four+ years combined software engineering and application security experience.
• Ability to read code in JS/TS, Python, Java/Kotlin, C#, Go, PHP, Ruby or Swift.
• Based in the United States and authorized to work there; client work follows US time zones.
• Strong reporting skills; a redacted sample report is required with the application.
• Able to work within a written scope and provide two professional references familiar with live engagements.

Responsibilities

• Triage static analysis results and remove false positives before reporting.
• Review authentication, authorization, input handling, cryptography, secrets management, and third‑party dependencies.
• Trace data flows across services to uncover cross‑component flaws.
• Document findings with file/line references, safe exploitability evidence, and remediation examples.
• Retest fixes and update reports.

Skills

Software engineering

Application security

Code review

Reporting

Job description

Role overview

Conduct security reviews of web, mobile, and backend code by combining static analysis with hands-on investigation. You will examine defined repository scopes, explain actionable risks to engineering teams, and verify that reported issues are fixed.

Responsibilities

• Triage static analysis results and remove false positives before reporting.
• Review authentication, authorization, input handling, cryptography, secrets management, and third-party dependencies.
• Trace data flows across services to uncover flaws that emerge from interactions between components.
• Document findings with file and line references, safe evidence of exploitability, and remediation examples where useful.
• Retest fixes and update reports.

Requirements

• At least four years of combined software engineering and application security experience, including regular production code review.
• Ability to read code in at least three of these language groups: JavaScript or TypeScript, Python, Java or Kotlin, C#, Go, PHP, Ruby, or Swift.
• Based in the United States and authorized to work there; client work follows US time zones.
• Strong reporting skills, with evidence useful to both engineers implementing fixes and auditors reviewing them; a redacted sample report is required with the application.
• Able to work within a written scope, identify scope problems early, and provide two professional references familiar with live engagements.

Nice to have

• Experience using static application security testing tools at scale or reviewing AI-generated code.
• Experience with iOS or Android codebases, infrastructure as code, or open-source security tooling.

Benefits and work setup

This is a full-time, remote role within the United States. Reviews typically cover a defined set of repositories over four-to-eight days, followed by retesting.