AppSec Engineer: Vulnerability Management & SBOM

Replit; California (MO); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Competitive Salary

Equity

401k Match

Health Insurance

Dental Insurance

Vision Insurance

Life Insurance

Disability Insurance

Parental Leave

Flexible PTO

Commuter Benefits

Wellness Stipend

Office Setup Reimbursement

Team Gatherings

Job summary

Replit is seeking a mid-level AppSec Vulnerability Management Engineer to bridge security, compliance, and engineering. You will identify vulnerabilities, manage SBOMs, and drive remediation across CI/CD.

You will serve as a technical responder during incidents and help mature supply chain security across multiple languages. The role requires strong development background and 5 years in AppSec/DevSecOps or similar.

Qualifications

• 5 years of experience in Application Security, DevSecOps, or Software Engineering roles.
• Development Background: Solid foundational experience working in a software development capacity.
• Code literacy: read, understand, and safely patch security flaws in JavaScript/TypeScript, Python, and Go.
• Build System Expertise: strong familiarity with build systems, package managers, and compilation workflows.
• AppSec Tooling Expertise: hands-on experience with SAST, SCA, and Secret Scanning tools (Snyk, Socket, Wiz Code, Semgrep, Checkmarx).
• Compliance Awareness: understanding of vulnerability management in SOC 2, ISO 27001, NIST contexts.

Responsibilities

• Vulnerability Scanning & Triage: perform periodic application security scanning; prioritize flaws by CVSS, exploitability, and exposure.
• Compliance-Driven Tracking: track and document vulnerabilities to meet strict SLAs (SOC 2, ISO 27001, PCI-DSS) with audit-ready evidence.
• Executive Reporting & Alerting: escalate exposures to CISO and leadership; maintain dashboards for risk trends and compliance posture.
• Software Supply Chain Security: own SBOM inventories; ensure SBOM accuracy and support SLSA maturity.
• Remediation Collaboration: partner with dev teams to provide mitigation paths and patch code when needed.
• Tooling Integration: tune automated security testing tools within CI/CD to reduce false positives.
• Incident Response Support: assist IR teams during breaches with real-time countermeasures.

Skills

AppSec

DevSecOps

Software Engineering

Code Literacy

JavaScript/TypeScript

Python

Go

Build Systems

SAST

SCA

Secret Scanning

Regulatory Compliance

Tools

Snyk

Socket

Wiz Code

Semgrep

Checkmarx

Job description

Replit is seeking a mid-level AppSec Vulnerability Management Engineer to bridge security, compliance, and engineering. You will identify vulnerabilities, manage SBOMs, and drive remediation across CI/CD.

You will serve as a technical responder during incidents and help mature supply chain security across multiple languages. The role requires strong development background and 5 years in AppSec/DevSecOps or similar.