AppSec Engineer (Backend/API) — Flexible & Equity

Rain; United States; Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

Unlimited time off

Flexible working

Health, dental, and vision coverage

401(k) with company match

Equity plan

Wellness stipend

Office meals

Team summits

Job summary

Rain is seeking an application security expert to own the security quality bar for non-chain findings. You will assess what is real, how severe it is, and what must be fixed before launch, pairing with engineers to ensure alignment beyond mere compliance.

You will lead security reviews of backend services, APIs and cloud infrastructure, with a focus on scalable, automated checks and reducing risk across Rain's platform. Collaboration with Security Operations will be essential.

Qualifications

• 4+ years in application or product security
• Experience reading and auditing TypeScript/Node.js code
• Hands-on cloud security (preferably GCP)
• Proficient with Terraform
• Experience with threat models or architecture reviews
• Able to ship checks over documents; use AI tools carefully

Responsibilities

• Review red team findings before engineers reach them and write clear tickets
• Harden backend services and APIs, and implement fixes
• Own edge defenses: DDoS protection, rate limiting, WAF rules
• Write secure configuration baselines for cloud, code, and SaaS
• Grow the PR security gate to block bugs earlier
• Own attack surface coverage and perform architecture reviews
• Find and test security tools and decide on buy/adopt/build

Skills

Security experience

Ownership of security decisions

Codebase comprehension (TS/Node.js)

Cloud security (GCP)

Terraform

Edge defenses (WAF; rate limiting)

Threat modeling & architecture reviews

Pragmatic security checks

AI tool usage in security

Tools

GCP

Terraform

WAFs

Job description

Rain is seeking an application security expert to own the security quality bar for non-chain findings. You will assess what is real, how severe it is, and what must be fixed before launch, pairing with engineers to ensure alignment beyond mere compliance.

You will lead security reviews of backend services, APIs and cloud infrastructure, with a focus on scalable, automated checks and reducing risk across Rain's platform. Collaboration with Security Operations will be essential.