AppSec Engineer: Secure Core APIs & Cloud Edge

Blueyard; United States; Hybrid; USD 120,000 - 190,000; Full time

Benefits offered by this job

Unlimited time off

Flexible working

Health benefits

401(k) with company match

Equity

Job summary

Rain is seeking an application security expert to act as the quality bar for non-chain findings. You’ll determine what is real, how severe it is, and what fixes are needed before launch. You’ll partner with engineers to ensure robust security without friction, owning the security posture across backend, APIs, cloud, and edge that handle real money.

You’ll guide threat modeling, run architecture reviews, and improve the security gate to prevent issues before merge, leveraging AI tools judiciously.

Qualifications

• 4+ years in application security or product security, or security-minded backend engineering.
• Ability to influence senior engineers on security design changes.
• Proficient in reading unfamiliar codebases (TypeScript/Node.js) and identifying impactful issues.
• Hands-on cloud security experience, preferably with GCP, Terraform, and edge defenses.
• Experience with threat modeling or architecture reviews; able to run tool compare-offs.
• Prefers practical, check-driven work and adept use of AI tools with skepticism.

Responsibilities

• Review red team findings, reproduce, trim false positives, set severity, and write actionable tickets.
• Harden backend services and APIs, especially money-moving paths; often implement fixes.
• Own edge defenses: DDoS protection, rate limiting, WAF rules, abuse controls.
• Write secure baselines for cloud, code, and SaaS; automate checks from baselines.
• Grow security gates to block bugs before code merges.
• Own attack surface coverage; conduct architecture reviews for high-risk systems.
• Evaluate security tools and decide on buying, adopting, or building.

Skills

4+ years in app security

Security decision ownership

TypeScript/Node.js reading

Cloud security (GCP)

Terraform

Edge defenses (WAF, rate limiting)

Threat modeling

Security tool evaluation

Tools

GCP

Terraform

WAFs

Rate limiting

Job description

Rain is seeking an application security expert to act as the quality bar for non-chain findings. You’ll determine what is real, how severe it is, and what fixes are needed before launch. You’ll partner with engineers to ensure robust security without friction, owning the security posture across backend, APIs, cloud, and edge that handle real money.

You’ll guide threat modeling, run architecture reviews, and improve the security gate to prevent issues before merge, leveraging AI tools judiciously.